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Abstract 


Terrorist  Use  of  the  Internet  and  Related  Information  Technologies,  by  Lt  Col  Patrick  S. 
Tibbetts,  U.S.  Air  Force,  64  pages. 

Research  Question:  how  will  U.S.  national  security  policy  be  affected  by  terrorist  exploitation 
of  the  Internet  and  related  information  technologies? 

Information  operations  are  nothing  new;  they  have  been  used  in  military  operations 
throughout  the  history  of  conflict.  Arguably,  however,  the  combination  of  breakneck  speed  of 
technological  advances  in  information  management  systems  and  evolving  threats  to  U.S.  national 
security  are  redefining  forever  the  nature  of  warfare.  Some  proponents  have  seen  the  great 
promise  of  information  operations  as  the  capability  to  mitigate,  if  not  eliminate,  the  fog  and 
friction  of  war  by  "seeing  all."  Consequently,  current  information  operations  doctrine  seems  to 
be  focused  squarely  on  the  advantages  of  using  leading  edge  technologies  to  obtain  real-time 
intelligence,  surveillance  and  reconnaissance,  thus  creating  a  "common  operating  picture"  of  a 
more  or  less  traditional  battlefield.  However,  as  the  recent  terrorist  attacks  in  New  York  and 
Washington  illustrate,  we  will  likely  continue  to  face  significant  threats  from  elusive, 
unconventional  enemies  operating  in  the  shadows  of  a  nontraditional  "battlefield."  Moreover, 
because  of  the  proliferation  of  cheap,  dual-use  information  technology,  these  enemies  may 
possess  now,  or  acquire  in  the  future,  the  technical  expertise  and  hardware  to  further  their  own 
political  agendas,  harass  and  frustrate  U.S.  attempts  to  conduct  information  operations  (perhaps 
even  to  the  extent  of  negating  U.S.  information  superiority  altogether),  or  directly  attack  the  U.S. 
infrastmcture  or  population.  Information  technology  has  thus  given  terrorists  their  own  ability  to 
"see  all"  on  their  own  traditional  battlefield:  the  populations  and  civilian  infrastmcture  of  the 
nations  they  wish  to  influence  or  destroy. 

In  order  to  answer  the  research  question,  the  monograph  will  examine  how  transnational 
actors  use  the  Internet  and  related  information  technologies  to  further  their  interests,  with  special 
emphasis  on  unconventional  warfare  and  the  profound  influence  of  accessible  advanced 
technology.  To  this  end,  it  will  document  current  and  future  methods  and  technologies  that 
terrorist  organizations  are  either  using  or  could  potentially  use  in  information  warfare  against  the 
United  States.  These  include  exploitation  of  the  Internet  and  related  information  technologies:  1) 
for  surreptitious  command,  control  and  communications;  2)  to  gain  access  to  information  of  all 
types;  3)  as  a  ubiquitous  source  of  funding;  4)  as  a  source  of  offensive  information  operations 
capability,  including  psychological  operations,  cyber  and  physical  attack  of  communications 
nodes,  and  cyber  attacks  of  critical  infrastmcture,  and  5)  for  publicity  and  propaganda.  The 
monograph  will  discuss  the  implications  of  these  capabilities,  and  suggest  enhancement  of  U.S. 
and  friendly  intelligence  capabilities  (particularly  information  sharing  and  human  intelligence), 
immigration  reform,  and  leveraging  Western  information  technology  superiority  as  priorities  in 
the  war  against  terrorism. 
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Chapter  One:  Introduction 


The  events  of  September  11,  2001,  marked  a  significant  turning  point  in  the  history  of  the 
United  States.  The  attacks  on  the  World  Trade  Center  and  the  Pentagon  -  carried  out  by 
operatives  of  the  A1  Qaeda  organization,  who  entered  the  country  legally  -  demonstrated  once 
and  for  all  that  the  United  States  is  not  invulnerable  to  attack  on  its  own  soil.  The  fact  that  the 
attacks  were  conducted  by  terrorists,  using  ingenious,  asymmetric  means  against  the  most 
technologically  and  militarily  sophisticated  society  in  the  world  -  the  world's  last  remaining 
superpower  -  has  generated  increased  study  of  terrorist  organizations,  their  objectives  and 
methods,  as  well  as  vigorous  attempts  to  determine  what  factors  led  to  their  success. 

The  various  failures  of  U.S.  national  security  policy  that  contributed  to  this  tragedy  may  have 
been  few  or  numerous;  they  are  not  yet  fully  understood,  and  will  undoubtedly  take  considerable 
time  to  identify,  analyze  and  correct.  Moreover,  this  effort  will  not  be  made  any  easier  by  the 
knowledge  that  the  precise  method  of  attack  had  already  been  predicted  long  before  the  event 
itself.  *  Nonetheless,  it  is  apparent  that  the  United  States  is  at  war,  and  definitely  not  with  a 
traditional  opponent.  Instead  of  a  set  piece,  military  versus  military  confrontation,  America  finds 
itself  challenged  by  a  shadowy,  non-state,  networked  and  adaptive  opponent  who  can  remain 
invisible  until  the  time  comes  to  accomplish  his  mission. 

This  new  type  of  opponent,  while  lacking  the  sophisticated  military  hardware  the  United 
States  possesses,  still  has  at  his  disposal  significant  capabilities  with  which  to  attack  or  facilitate 
attacks  on  American  interests  worldwide.  Some  of  these  capabilities  involve  using  the  Internet 
and  related  information  technologies  to  facilitate  achievement  of  their  objectives.  Although  not 
necessarily  an  exhaustive  list,  the  Internet  provides  terrorist  groups  with  the  following 
opportunities  and  capabilities: 

^  See,  for  example,  Stephen  Sloan,  "Terrorism  and  Asymmetry,"  Challenging  the  United  States 
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1)  surreptitious  command,  control  and  communications  capabilities; 

2)  enhanced  access  to  information  of  all  types; 

3)  a  ubiquitous  source  of  funding,  money  laundering,  and  electronic  transfers; 

4)  a  means  to  conduct  asymmetric,  offensive  information  operations,  and 

5)  global  publicity  and  recmiting. 

This  monograph  examines  all  of  these  capabilities  and  opportunities,  which  in  combination 

afford  terrorist  organizations  with  ample  means  to  achieve  competence  in,  if  not  mastery  of,  what 

Alberts,  Gartska  and  Stein  have  called  "network-centric  warfare."  This  mode  of  warfare 

focuses  on  the  combat  power  that  can  be  generated  from  the  effective  linking  or 
networking  of  the  warfighting  enterprise.  It  is  characterized  by  the  ability  of 
geographically  dispersed  forces  (consisting  of  entities)  to  create  a  high  level  of  shared 
battlespace  awareness  that  can  be  exploited  via  self-synchronization  and  other  network¬ 
centric  operations  to  achieve  commanders’  intent.^ 

Although  the  implications  of  these  developments  are  not  altogether  clear,  at  least  with  respect 
to  national  security  policy,  it  is  nonetheless  evident  that  the  U.S.  will  need  to  adjust  to  the  new 
threat.  Because  information  technology  gives  terrorist  organizations  global  power  and  reach 
without  necessarily  compromising  their  invisibility,  the  U.S.  must  enhance  its  own  capabilities  to 
reveal  and  effectively  target  terrorist  cells  and  operatives  wherever  they  hide,  as  well  as  prevent 
those  outside  of  the  country  from  entering.  To  this  end,  an  effective  U.S.  response  will  require,  at 
the  very  least: 

1)  a  more  networked  approach  to  defense,  involving  interagency  and  international 
cooperation  of  unprecedented  scope,  particularly  in  the  field  of  intelligence  and 
information  sharing; 

2)  extensive  immigration  reform  to  identify  and  eliminate  the  vulnerable  seams  in  U.S. 
borders,  and 

3)  a  definite  commitment  to  fully  leverage  American  technological  superiority,  especially 
in  Internet  and  related  information  technologies. 


Symmetrically  and  Asymmetrically:  Can  America  Be  Defeated?  (Carlisle  Barracks,  Pennsylvania:  U.S. 
Army  War  College,  July  1998),  p.  180. 

^  David  S.  Alberts,  John  J.  Garstka,  and  Frederick  P.  Stein,  Network  Centric  Warfare:Developing  and 
Leveraging  Information  Superiority  (Washington,  D.C.:  DoD  C4ISR  Cooperative  Research  Program, 
1999),  p. 
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Chapter  Two:  Surreptitious  Command,  Controi  and 
Communications 


Current  military  literature  makes  much  of  U.S.  technological  superiority,  particularly  the 
Western  lead  in  computer  technology  and  its  inherent  advantages  in  command,  control, 
communications,  computers,  intelligence,  surveillance  and  reconnaissance  (C4ISR). 
Distinguished  thinkers  such  as  former  U.S.  Air  Force  Chief  of  Staff  Ronald  R.  Fogleman  see 
these  technological  advances  as  creating  a  revolution  in  military  affairs:  one  that  will  provide 
near-perfect  battlefield  information  to  commanders  at  all  echelons,  enhancing  military  capability 
to  find  and  destroy  valuable  enemy  targets  at  stand  off  distances.^  Like  most  technological 
advances  throughout  history,  however,  C4ISR  technologies  have  proliferated:  they  are  no  longer 
a  Western  monopoly.  Because  they  are  so  widely  available,  and  because  developed  information 
societies  are  so  dependent  upon  them,  the  strengths  of  Internet  and  computer  technologies  in 
general  -  including  automated  information  processing,  global  communications  interconnectivity, 
and  other  capabilities  —  are  arguably  even  more  useful  to  transnational  and  non-state  actors  than 
they  are  to  industrialized  nation-states.  Although  the  United  States  is  currently  in  a  position  of 
technological  advantage,  this  proliferation  of  cheap,  dual-use  software  allows  entities  with 
otherwise  modest  means  to  conduct  command  and  control  globally,  in  real  time,  and  with 
considerable  security.  Using  this  technology,  terrorist  organizations  can  and  do  achieve  secure, 
real-time  command  and  control  by  exploiting  the  utility  of  Internet-based  applications 
themselves,  by  using  encryption  to  prevent  unauthorized  disclosure  of  information  in  stored  and 
transmitted  electronic  files,  and  by  using  information  hiding  methods  to  conceal  the  relevant 
content  of  certain  types  of  files. 


^  Ronald  R.  Fogleman,  "Information  Operations:  The  Fifth  Dimension  of  Warfare,"  1995  [online];  available 
from  <http://www.defenselink.mil/speeches/1995/sl9950425-fogleman.html>  (accessed  24  September 
2001). 
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The  Internet  as  a  Terrorist  Command  and  Control  Tool 


The  first  method  exploits  the  various  built-in  tools  that  make  the  Internet  useful  in  the  first 
place.  For  example,  members  of  terrorist  groups,  with  the  use  of  fraudulent  or  non-existent  credit 
card  numbers,  can  open  an  unlimited  number  of  Internet  accounts  with  national  Internet  service 
providers  such  as  America  Online  (AOL).  Even  without  an  AOL  account,  terrorists  can  create  an 
AOL  Instant  Messenger  (AIM)  account  on  a  short-term  or  ad  hoc  basis  with  a  phony  e-mail 
address.'*  Offenders  can  use  these  tools  for  real-time  communication  to  coordinate  their  activities 
with  little  chance  of  interception:  until  it  is  too  late  to  stop  them.  Then,  once  the  current  operation 
is  complete,  they  can  discard  these  bogus  AIM  accounts  merely  by  uninstalling  the  software  and 
formatting  the  computer's  hard  drive  to  erase  all  evidence  that  it  was  ever  there.  Usually,  the 
service  providers  eventually  cancel  these  accounts  once  they  are  ascertained  to  be  fraudulent; 
however,  in  order  to  be  a  threat  they  only  need  to  be  active  long  enough  to  suit  a  short-term 
purpose. 

Terrorist  organizations  also  use  existing  Internet  chat  rooms  and  e-mail  to  plan  and 
coordinate  operations.^  Many  chat  rooms  are  available  for  anonymous  login,  and  can  be  accessed 
from  cyber  cafes,  libraries  or  other  Internet  connections  not  traceable  to  a  suspected  terrorist 
group  or  member.  Free  e-mail  hosting  is  also  popular  and  available  from  a  variety  of  sources. 

Not  only  do  terrorist  organizations  use  existing  Internet  services,  they  have  constructed  dedicated 
communications  networks  that  utilize  e-mail,  the  Internet  and  electronic  bulletin  boards  (EBBs) 
to  conduct  seamless  information  processing  and  communications,  both  internal  and  external.  ® 
When  used  in  conjunction  with  any  of  a  number  of  features  available  on  the  Internet  - 


'*  The  relative  ease  and  unobtrusiveness  of  the  AIM  registration  process  is  apparent  at  the  AIM  Home  Page. 

See _ ,  "AOL  Instant  Messenger  Home  Page,"  America  Online  Incorporated,  no  date  [online]; 

available  from  <http://www.aim.com/>  (accessed  4  December  2001). 

^  Dorothy  E.  Denning,  "Cyberterrorism,"  24  August  2000  [online];  available  from 
<http://www.cs.georgetown.edu/~denning/infosec/cyberterror-GD.doc>  (accessed  7  January  2002). 

®  Ibid. 
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anonymous  mailers  such  as  Send  Fake  Mail,’  or  re-mailer  utilities  such  as  Jack  B.  Nymble  ®  -  e- 
mail  can  be  a  powerful,  responsive  short-term  tool  to  accomplish  command  and  control  tasks  in  a 
relatively  secure  manner. 

Terrorist  Information  Security 

Encryption  and  information  hiding  technologies  currently  available  allow  almost  anyone  with 
an  Internet  connection  to  achieve  high  levels  of  security  for  selected  files,  communications  or 
even  whole  systems.  Numerous  means  exist  by  which  terrorist  organizations  can  effectively 
scramble  and  conceal  messages  or  files.  These  methods  include  use  of  easily  obtainable,  dual-use 
technology,  including  digital  steganography  and  other  information-masking  techniques.  Dating 
back  at  least  to  ancient  Greece,  steganography  is  not  a  new  science.  Digital  steganography, 
however,  is  relatively  new.  Its  purpose  is  to  hide  digital  information,  sometimes  within 
completely  unrelated  types  of  files.  It  is  related  to  digital  watermarking,  which  inserts 
information  (usually  copyright  data)  into  digital  material  in  an  effort  to  protect  Internet  graphics 
and  other  files  that  are  susceptible  to  copyright  infringement.  However,  this  technology  can  also 
support  terrorist  groups  in  that  its  main  purpose  is  to  conceal  "a  message  where  that  hidden 
message  is  the  object  of  the  communication;  for  example,  sending  a  satellite  photograph  hidden 
in  another  image.  Although  these  digital  signatures  are  not  easily  detected  without  appropriate 
software  and  technical  expertise,  they  are  in  widespread  use.  The  important  point  is  the  same 
procedure  may  also  be  used  to  insert  hidden  messages  into  virtually  any  digital  file  extant  on  the 
Internet. 


_ ,  "Send  Fake  Mail,"  Sendfake-mail.com,  no  date  [online];  available  from  <http://www.sendfake- 

mail.com/>  (accessed  17  November  2001). 

* _ ,  "Jack  B.  Nymble  v2,"  Potato  Software,  no  date  [online];  available  from 

<http://www.bigfoot.com/~potatoware/jbn2/>  (accessed  17  November  2001). 

®  Neil  F.  Johnson  and  Shushil  Jajodia,  "Steganalysis  of  Images  Created  Using  Current  Staganographic 
Software,"  1998  [online];  available  from  <http://www.isse.gmu.edu/~njohnson/ihws98/jjgmu.html> 
(accessed  12  November  2001).  Originally  published  in  Lecture  Notes  in  Computer  Science,  Vol.  1525, 
(Springer- Verlag,  1998),  pp.  273-289. 
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Terrorists  also  have  access  to  what  is  generally  termed  "strong"  encryption  capability. 
Originally  developed  in  the  United  States,  this  type  of  encryption  is  used  legally  for  a  number  of 
purposes;  chiefly,  to  support  secure  socket  layer  Internet  communications,  thus  providing 
significant  protection  from  fraud  for  those  merchants  and  consumers  engaged  in  electronic 
commerce.  Since  this  form  of  encryption  utilizes  so  many  variables  in  its  key,  it  is  virtually 
unbreakable;  the  computing  power  required  to  decrypt  a  message  protected  with  1024-bit 
encryption  within  a  reasonable  period  of  time,  for  example,  would  require  thousands  of  times  the 
current  number  of  computers  in  existence  today. Although  this  technology  is  a  boon  to  those 
legitimate  activities  requiring  secure  communications  over  the  Internet,  its  ready  availability 
makes  it  a  powerful  security  tool  for  terrorist  command,  control  and  communications." 

Terrorists  can  also  use  the  same  encryption  technology  to  conceal  real-time  Internet  voice 
communications.  Pretty  Good  Privacy  (PGP)  author  Phil  Zimmermann  has  published  a  secure 
Internet  telephony  program  called  PGPfone,  which  uses  strong  encryption  protocols  based  on 
PGP  as  well  as  speech  compression  technology  to  allow  any  user  to  convert  his  or  her  computer 
into  a  virtual  STU-III  device.*^ 

An  interesting  analog  of  encryption  software  hides  messages  within  the  text  of  ordinary  e- 

mail.  Spammimic,  offered  by  Spammimic.com,  is  one  example.  Unlike  tools  that  perform  tme 

file  encryption,  Spammimic  hides  the  text  of  a  short  message  into  what  appears  to  be  mn-of-the- 

mill  "spam:"  a  pejorative  reference  to  unsolicited,  bulk  commercial  e-mail.  Spammimic.com 

explains  the  advantages  of  this  method  as  follows: 

There  is  [sic]  tons  of  spam  flying  around  the  Internet.  Most  people  can't  delete  it  fast 
enough.  It's  virtually  invisible.  This  site  gives  you  access  to  a  program  that  will  encrypt 


Hal  Abelson  et  al.,  "Questions  and  Answers  about  MIT's  Release  of  PGP  2.6,"  2  June  1994  [online]; 
available  from  <http://web.mit.edu/afs/net/mit/jis/www/pgpfaq.html>  (accessed  14  November  2001). 

"  One  encryption  program  in  widespread  use.  Pretty  Good  Privacy  (PGP),  is  available  from  a  number  of 

sites  online;  see _ ,  "The  International  PGP  Home  Page,”  no  date  [online];  available  from 

<http://www.pgpi.org/>. 

Jeffrey  L.  Schiller,  "PGPfone  Home  Page,"  10  June  1997  [online];  available  from 
<http://web.mit.edu/network/pgpfone/>  (accessed  10  November  2001). 

"  Its  non-digital  equivalent  is  Class  A  Bulk  mail,  also  known  as  "junk  mail”  in  the  United  States. 
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a  short  message  into  spam.  Basically,  the  sentences  it  outputs  vary  depending  on  the 
message  you  are  encoding.  Real  spam  is  so  stupidly  written  it's  sometimes  hard  to  tell 
the  machine  written  spam  from  the  genuine  article. 

Spammimic  thus  appears  to  be  the  digital  equivalent  of  a  null  cipher;  that  is,  an  unencrypted 
message  concealed  within  innocuous-appearing  text.  It  is  relatively  easy  to  "crack"  a  null  cipher, 
but  Spammimic' s  significance  lies  not  in  the  simplicity  of  its  code.  Potentially,  anyone  with  an 
Internet  connection  and  rudimentary,  "cut-and-paste"  computer  skills  can  use  this  tool  to  hide 
secret  messages  amongst  the  millions  of  "spam"  e-mails  sent  daily  throughout  the  world.  As  e- 
mail  volume  increases  over  time,  the  challenge  of  detecting  potential  terrorist  communications 
using  this  method  becomes  daunting  indeed.  One  research  firm  estimates  that  unsolicited 
commercial  e-mail  volume  in  the  United  States  alone  will  reach  200  billion  per  year  by  2004. 
Moreover,  as  Spammimic's  creators  point  out,  "there  are  terrific  tools. .  .for  encrypting  your  mail. 
If  somebody  along  the  way  looks  at  the  mail  they  can't  understand  it.  But  they  do  know  you  are 
sending  encrypted  mail  to  your  pal."''’  Using  Spammimic  allows  users  to  avoid  the  telltale 
hallmarks  of  data  encryption  in  e-mails  containing  sensitive  information,  thus  lowering  the 
possibility  they  will  attract  the  unwanted  attention  or  suspicion  of  law  enforcement  and 
intelligence  agencies. 

A  side  benefit  of  digital  cryptography  is  its  potential  as  a  tool  for  extortion  and  blackmail. 
Since  cryptographic  technology  is  available  free  to  anyone  with  an  Internet  connection,  it  is 
entirely  possible  to  fashion  computer  viruses  which  encrypt  selected  files  on  a  targeted  hard 
drive,  rendering  them  useless  to  anyone  without  the  key.  Depending  on  the  sensitivity  or  value  of 
the  encrypted  files,  this  type  of  scheme  could  generate  significant  resources  for  the  perpetrator  in 
terms  of  hard  cash,  or  in-kind  transfers  of  goods  and  services  vital  to  a  terrorist  organization's 

_ ,  "Explanation,"  Spammimic.com,  no  date  [online];  available  from 

<http://www.spammimic.com/explain.slitml>  (accessed  1  January  2002). 

_ ,  "E-mail  Landscape,"  Iconocast  Inc.,  no  date  [online];  available  from 

<http://www.iconocast.com/dotcom/marketing/e-mail.html>  (accessed  7  Jan  2002). 

_ ,  "Explanation,"  Spammimic.com,  no  date  [online];  available  from 

<http://www.spammimic.com/explain.shtml>  (accessed  1  January  2002). 
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operations.  (This  monograph  addresses  additional  terrorist  uses  of  computer  and  Internet 
technology  as  a  means  to  finance  operating  expenses  in  Chapter  Four,  "Ubiquitous  Source  of 
Funding.") 

The  implications  of  these  capabilities  are  enormous.  With  this  technology,  terrorists  can  now 
exercise  discreet  -  even  secure  -  command  and  control  of  paramilitary  forces  at  global  distances. 
Since  their  command  and  control  apparatus  is  no  longer  constrained  by  the  limits  of  geography, 
line-of-sight  communications,  or  the  speed  of  the  fastest  available  courier,  they  can  now  project 
lethal  force  across  continents,  with  more  precision  and  better  coordination,  and  hence  better 
chance  of  spectacular  success.  In  addition,  cheap,  readily  available  encryption  technology 
compounds  the  already  significant  difficulties  in  monitoring  even  "in  the  clear"  digital  Internet 
communications.  One  factor  is  its  sheer  size  and  scope;  the  Internet  is  becoming  more  pervasive 
on  a  daily  basis,  and  crosses  international  borders.  It  also  encompasses  a  wide  variety  of 
communication  capabilities,  such  as  e-mail,  instant  messaging,  chat  rooms,  electronic  bulletin 
boards,  and  real-time  streaming  video.  Finally,  just  as  they  must  with  every  other 
communications  medium,  governments  of  free  societies  must  make  convincing  arguments  to 
address  the  privacy  concerns  of  Internet  users  in  order  to  implement  effective  countermeasures. 
For  these  reasons,  the  Internet  is  not  as  susceptible  to  traditional  law  enforcement  methods  of 
intercepting  communications,  such  as  wiretapping  or  other  forms  of  surveillance.** 


Michael  Wilson,  "Terrorism  in  a  New  World,”  Emergency  Response  and  Research  Institute,  1994 
[online];  available  from  <http://www.emergency.com/evo-revo.htm>  (accessed  7  Jan  2002). 

Serena  Chan  and  L.  Jean  Camp,  "Towards  Coherent  Regulation  of  Law  Enforcement  Surveillance  in  the 
Network  Society,"  2001  [online];  available  from 

<http://itc.mit.edu/rpcp/member/seminar/chan_031501.pdf>  (accessed  16  December  2001). 
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Chapter  Three:  Enhanced  Access  to  Information 

Information  technology  is  revolutionizing  research  of  all  kinds  -  academic,  corporate, 
professional  and  nefarious.  The  sheer  volume  of  information  available  to  anyone  with  an  Internet 
connection  is  staggering:  a  University  of  California  at  Berkeley  study  found  the  total  content  of 
all  Web-accessible  information  in  the  year  2000  included  over  7,500  terabytes  of  data  comprising 
over  550  billion  documents.  The  same  study  revealed  that  the  "surface"  Web  alone  was  growing 
at  a  rate  of  7.3  million  pages  per  day  in  2000. With  any  of  the  dozens  of  Internet  search  engines 
and  directories  available,  it  is  easier  than  ever  for  researchers  to  pinpoint  specific  information 
quickly.  This  has  also  affected  intelligence  collection,  since  ready  access  to  open-source 
information  has  increased  commensurately;  as  Steele  points  out,  "the  vast  majority  of  usable, 
relevant  information  necessary  to  support  policymakers,  acquisition  managers,  and  commanders 
is  available  in  unclassified  form  from  private  sector  sources,"  including  the  Internet.^”  The 
increased  availability  of  information  has  been  a  boon  not  just  to  legitimate  researchers,  or  even  to 
friendly  intelligence  specialists:  it  is  also  available  to  those  whose  agendas  are  less  noble. 
Terrorists  can  and  do  use  the  power  of  the  Internet  to  obtain  a  wealth  of  data  on  potential  targets, 
as  well  as  technical  know-how  on  the  constmction  and  employment  of  a  variety  of  conventional 
and  unconventional  weapons. 

Targeting  Tools 

One  source  of  targeting  data  that  terrorists  can  exploit  is  commercial  satellite  imagery.  There 
are  numerous  sources  of  geospatial  data  available  on  the  Web.  Many  are  of  limited  utility  or  are 
restricted  access  sites,  but  there  are  also  several  sources  of  commercially  available  satellite 

Peter  Lyman  and  Hal  R.  Varian,  "How  Much  Information,"  2000  [online];  available  from 
<http://www.sims.berkeley.edu/research/projects/how-much-info/internet.html>  (accessed  22  September 
2001). 

Robert  D.  Steele,  "Information  Peacekeeping:  The  Purest  Form  of  War,"  in  Challenging  the  United 
States  Symmetrically  and  Asymmetrically:  Can  America  Be  Defeated?  (Carlisle  Barracks,  Pennsylvania: 
U.S.  Army  War  College  Strategic  Studies  Institute,  July  1998),  pp.  157-158. 
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imagery  with  sufficient  resolution  to  serve  as  targeting  or  planning  tools.  Space  Imaging, 
Incorporated  is  probably  the  best-known  provider  of  high-resolution  commercial  satellite 
photography.  Their  IKONOS  satellite  was  the  first  commercial  satellite  to  deliver  one-meter 
resolution  black-and-white,  and  four-meter  resolution  color  images.^'  However,  DigitalGlobe  is 
poised  to  take  the  lead  in  this  arena  in  2002  with  its  QuickBird  satellite,  which  will  deliver 
seventy-centimeter  resolution  black-and-white,  and  280-centimeter  resolution  color  images.^^ 

In  addition  to  these  two  companies,  there  are  at  least  five  others,  some  of  which  are  actually 
resellers  of  archived  imagery,  that  offer  some  type  of  space  imagery  on  the  Internet,  either  free  or 
for  very  low  prices.^^  For  example,  as  late  as  January  2002  -  long  after  the  September  1 1  attacks 
-  the  author  was  able  to  download  one-meter  resolution  images  of  the  Pentagon,  the  Washington 
Monument,  and  the  U.S.  Capitol  from  the  TerraServer  Web  site.^"^ 

Precise  intelligence  on  high- visibility  targets  is  only  one  advantage  of  this  technology.  High- 
resolution  satellite  imagery  can  also  give  terrorists  an  unacceptable  level  of  insight  into  our  own 
antiterrorism  and  counterterrorism  efforts.  Recognizing  the  threat  to  military  operations  posed  by 
commercially  available  intelligence  sources  focused  on  Afghanistan  since  September  11,  the 
National  Imagery  and  Mapping  Agency  (NIMA)  has  already  purchased  all  rights  to  Afghanistan 


_ ,  "Geo  Im  and  4m  Frequently  Asked  Questions,”  Space  Imaging  Incorporated,  no  date  [online]; 

available  from  <http://www.spaceimaging.com/carterra/geo/prodinfo/geo_faq.htm>  (accessed  17 
December  2001). 

_ ,  "DigitalGlobe  Overview,”  DigitalGlobe,  no  date  [online];  available  from 

<http://www.digitalglobe.com/?goto=about>  (accessed  21  December  2001). 

See _ ,  "ImageNet,”  Core  Software  Technology,  no  date  [online];  available  from 

<http://www.imagenet.com/info.html>; _ ,  "High-Resolution  Satellite  Imagery,”  PlanGraphics, 

Incorporated,  2000  [online];  available  from  <http://www.plangraphics.com/satellite.htm>; _ ,  "The 

GEMI  Store  Online,”  GEMI  Corporation,  2000  [online];  available  from 

<http://www.eomonline.com/CommonGEMI/Aboutus/about.htm>; _ ,  "Satellite  Photos,  Aerial 

Photography,  and  Images,"  TerraServer. Com,  no  date  [online];  available  from 

<http://www.terraserver.com/>,  and _ ,  "SPOT  Image  Corporation  Home  Page,”  SPOT  Image 

Corporation,  no  date  [online];  available  from  <http://www.spot.com/>  (all  URLs  accessed  22  December 
2001). 

Imagery  of  the  Pentagon,  the  Washington  Monument  and  the  U.S.  Capitol  was  still  available  online  on 
15  January  2002  at  the  following  URLs,  respectively: 

http://terraserver.homeadvisor.msn.com/image. asp?S=10&T=l&X=1608&Y=21522&Z=18&W=0; 
http://terraserver.homeadvisor.msn. com/image. asp?S=10&T=l&X=  16 17&Y=21532&Z=18&W=0,  and 
http://terraserver.homeadvisor.msn. com/image. asp?S=10&T=l&X=1628&Y=21532&Z=18&W=0. 
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imagery  from  Space  Imaging’s  IKONOS  satellite,  and  has  expressed  interest  in  obtaining 
material  from  DigitalGlobe’s  QuickBird  as  well.  NIMA’s  agreement  with  Space  Imaging 
guarantees  rights  to  this  imagery  in  perpetuity;  essentially,  this  means  that  third  parties,  including 
the  media,  cannot  legally  gain  access  to  these  materials  without  explicit  U.S.  government 
permission. 

Detailed  information  on  U.S.  infrastmcture  available  on  the  Internet  is  not  limited  to  high- 
resolution  space  imagery,  however.  Terrorists  can  also  obtain  maps,  diagrams  and  other 
information  on  a  variety  of  public  utilities,  national  historic  landmarks,  population-dense  facilities 
such  as  shopping  centers  and  malls,  transportation  hubs,  and  other  potential  targets.  One 
particularly  alarming  example  is  the  wealth  of  information  on  U.S.  nuclear  reactors,  including 
specific  information  on  containment  facilities,  available  to  anyone  with  an  Internet  connection. 
Prior  to  the  events  of  September  11,  2001,  some  of  this  information  was  actually  available  on 
government  Web  sites.  For  example,  broken  links  to  reactor  locations  and  maps,  as  well  as 
statistics,  diagrams  and  other  plant-specific  data,  still  exist  online  at  the  Nuclear  Regulatory 
Commission  web  site.^*’  Links  to  similar  information  at  the  Yucca  Mountain  nuclear  waste 
repository  Web  site  result  in  a  security  notice  specifying  the  removal  of  certain  types  of  technical 
information,  including  maps.^’ 

Notwithstanding  the  events  of  September  1 1 ,  however,  descriptions  and  maps  of 
transportation  routes  for  high-level  nuclear  waste  in  Nevada  are  still  available  online.  Potential 
terrorist  actors  can  easily  access  information  about  the  routes  themselves,  as  well  as  shipping 


Michael  R.  Gordon,  “Pentagon  Corners  Output  of  Special  Afghan  Images,’’  The  New  York  Times,  18 
October  2001  [online];  available  from  <http://206.181.245.163/ebird/e20011019pentagon.htm>  (accessed  4 
November  2001). 

See  United  States  Nuclear  Regulatory  Commission  ,  "NRC  -  What's  New,”  no  date  [online];  available 
from  <http://www.nrc.gov/site-help/new-content.html>,  and  ”  NRC:  Schedule  for  Rebuilding  NRC's  Web 
Site,"  no  date  [online];  available  from  <http://www.nrc.gov/site-help/new-content/rebuild-schedule.html> 
(both  URLs  accessed  17  January  2002). 

See  U.S.  Department  of  Energy,  Office  of  Civilian  Radioactive  Waste  Management,  "Maps,”  no  date 
[online];  available  from  <http://www.ymp.gov/reference/maps/index.htm>  (accessed  28  December  2001). 
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origins  and  destinations.^*  Also,  although  the  U.S.  government  has  removed  much  of  the  more 
sensitive  information  from  its  Web  sites,  alternative  sources  of  similar  content  still  exist.  The 
Animated  Software  Company's  Web  site  has  off-topic  documents  containing  locations,  status, 
security  procedures  and  other  technical  information  concerning  dozens  of  U.S.  reactors.^®  The 
Virtual  Nuclear  Tourist  site  contains  similar  information;  this  site  is  particularly  detailed  on 
specific  security  measures  that  may  be  implemented  at  various  nuclear  reactor  locations 
worldwide.*” 

Technical  Information  on  Weapons  Construction 

Although  the  Internet  is  thus  a  source  of  intelligence  for  terrorist  groups,  planning  or 
targeting  information  derived  from  the  Internet  is  practically  useless  to  an  enemy  that  lacks  the 
means  to  strike  targets.  This  fact  may  help  to  explain  why  information  about  United  States 
critical  infrastmcture  has  always  been  more  or  less  transparent  on  the  Web;  in  recent  history,  the 
only  entities  capable  of  striking  vital  targets  on  U.S.  soil  have  been  nation-states,  which  are 
themselves  easier  to  target  than  shadowy  terrorist  organizations,  and  which  in  any  event  would 
risk  full-scale  retaliation  for  any  act  of  aggression  within  the  U.S.  itself  The  explosion  of  the 
Internet,  however,  has  also  made  technical  knowledge  -  including  the  science  of  weapons  of 
mass  destruction  -  readily  available.  Of  particular  concern  in  this  regard  is  the  proliferation  of 
"how  to"  web  pages  devoted  to  explaining  the  technical  intricacies  of  homemade  bombs,  which 
can  in  many  cases  be  constructed  using  lethal  combinations  of  otherwise  innocuous  materials. 
Much  of  this  information  has  been  available  in  print  media  since  at  least  the  late  1960s,  with  the 


**  State  of  Nevada,  "Nuclear  Waste  Transportation  Routes  -  U.S.,"  no  date  [online];  available  from 
<http://www.state.nv.us/nucwaste/states/us.litm>  (accessed  14  December  2001). 

29 

_ ,  "List  of  Nuclear  Power  Plants  in  America,”  The  Animated  Software  Company,  no  date  [online]; 

available  from  <http://www.animatedsoftware.com/environm/no_nukes/nukelistl.htm>  (accessed  11 
December  2001). 

*”  Joseph  Gonyeau,  "Joseph  Gonyeau's  Virtual  Nuclear  Tourist:  Nuclear  Plants  Around  the  World,"  no  date 
[online];  available  from  <http://www.nucleartourist.com/>  (accessed  12  December  2001).  Plant  security 
data  was  available  on  this  site  at  <http://www.nucleartourist.com/areas/security.htm>  (accessed  12 
December  2001). 
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publication  of  William  Powell's  The  Anarchist  Cookbook  and  other,  similar  titles.  Today,  there 
are  numerous  Internet  documents  with  such  information.  As  early  as  April  1997,  the  Department 
of  Justice  had  concluded  that  the  availability  of  this  information  played  a  significant  role  in 
facilitating  terrorist  and  other  criminal  acts: 

It  is  readily  apparent  from  our  cursory  examination  that  anyone  interested  in  manufacturing  a 
bomb,  dangerous  weapon  or  weapon  of  mass  destmction  can  easily  obtain  detailed 
instructions  for  fabricating  and  using  such  a  device.  Available  sources  include  not  only 
publications  from  the  so  called  underground  press  but  also  manuals  written  for  legitimate 
purposes,  such  as  military,  agricultural,  industrial  and  engineering  purposes.  Such 
information  is  also  readily  available  to  anyone  with  access  to  a  home  computer  equipped 
with  a  modem  [italics  mine].^* 

The  author's  own  Web  research  revealed  that,  despite  Congressional  efforts  to  put  the  lid  on 
sensitive  information  of  this  kind,  even  a  cursory  search  of  the  Web  revealed  dozens  of 
documents  containing  bomb  making  techniques  and  procedures  Moreover,  information  on 
cmde  weapons  constmction  is  not  limited  to  garden-variety  pipe  bombs,  Molotov  cocktails,  or 
other,  similar  devices.  A  single  search  of  the  Web  with  the  Google  search  engine,  using  search 
terms  "how  to  build  a  nuclear  weapon"  revealed  a  minimum  of  five  sites  with  detailed 
information  on  the  construction  of  a  cmde  nuclear  device.^^  Although  the  challenge  of  building  a 
tme  fissile  device  while  maintaining  secrecy  is  daunting,  the  challenge  of  building  a  so-called 


U.S.  Department  of  Justice,  "Report  On  The  Availability  of  Bombmaking  Information,  the  Extent  to 
Which  Its  Dissemination  Is  Controlled  by  Federal  Law,  and  the  Extent  to  Which  Such  Dissemination  May 
Be  Subject  to  Regulation  Consistent  With  the  First  Amendment  to  the  United  States  Constitution,”  April 
1997  [online];  available  from  <http://cryptome.org/abi.htm>  (accessed  20  November  2001). 

See _ ,  "Anarchist  Cookbook,  Terrorist  Handbook,"  no  date  [online];  available  from 

<http://come.to/anarchy>  (accessed  21  November  2001),  which  contains  online  versions  of  The  Anarchist 

Cookbook  and  The  Terrorist  Handbook .  For  pipe  bomb  making  instructions,  see _ ,  "Contact  Pipe 

Bomb,”  2001  [online];  available  from 

<http://www.totse.com/en/bad_ideas/ka_fucking_boom/162267.html>  and _ ,  "Manual  of  the 

Anarchist,  Vol  I,”  4  January  1985  [online];  available  from  <http://www.etext.org/CuD/Misc/anarch>. 

See _ ,  "How  to  Build  a  Thermonuclear  Bomb,"  About,  Incorporated,  no  date  [online];  available 

from  <http://physics.about.eom/c/ht/00/07/How_Build_Thermonuclear_Bomb0964152140.htm>; _ , 

"Let's  Build  a  Nuke,"  no  date  [online];  available  from 

<http://home.clara.net/nybbles/oldestuff/vik/nuke/index2.html>; _ ,  "Atomic  Bomb  Design,"  no  date 

[online];  available  from  <http://www.accutek.com/%7Emoistner/nuclearLhtm>;  Carey  Sublette, 
"Introduction  to  Nuclear  Weapon  Physics  and  Design,"  20  February  1999  [online];  available  from 
<http://nuketesting.enviroweb.org/hew/Nwfaq/Nfaq2.html>,  and  Carey  Sublette,  "Engineering  and  Design 
of  Nuclear  Weapons,"  20  February  1999  [online];  available  from 

<http://nuketesting.enviroweb.org/hew/Nwfaq/Nfaq4.html>  (all  URLs  accessed  3  December  2001). 
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"dirty  bomb"  is  not  as  difficult.  In  what  is  perhaps  the  most  chilling  current  scenario,  terrorists 
could  easily  obtain  techniques,  even  from  legitimate  web  sites,  for  building  radiological 
weapons.^"^  Such  weapons  may  be  less  physically  destmctive  than  tme  fissile  weapons,  but  they 
could  kill  or  injure  thousands  if  detonated  in  a  population-dense  environment.  More  importantly, 
their  capacity  for  spreading  fear  -  what  is  arguably  the  ultimate  terrorist  objective  -  could  be 
even  more  potent  than  the  attacks  on  the  World  Trade  Center  and  the  Pentagon. 

The  feasibility  of  these  threats  should  not  be  underestimated.  Recently  captured  materials 
indicate  that  the  terrorist  organization  A1  Qaeda  not  only  compiled  information  on  "home-grown 
explosives,"  but  also  was  actively  pursuing  data  and  technical  expertise  necessary  to  pursue 
nuclear,  chemical  and  biological  weapons  programs.^^  Moreover,  according  to  Ken  Katzman,  a 
terrorism  analyst  for  the  Congressional  Research  Service,  much  of  the  material  in  these  captured 
documents  was  probably  downloaded  from  the  Internet.^®  Therefore,  it  is  also  important  to  note 
that  removal  of  technical  information  from  the  public  domain  is  no  guarantee  of  safeguarding  it; 
in  essence,  this  effort  is  akin  to  "closing  the  bam  door  after  the  cow  has  escaped."  Terrorist 
intelligence  and  technical  data  obtained  prior  to  September  1 1  can  be  archived,  stored  and 
distributed  surreptitiously  irrespective  of  government  or  private  attempts  to  squelch  its  presence 
on  the  Internet.  Indeed,  these  materials  can  be  loaded  onto  offshore  or  other  international  Web 
servers  that  cannot  be  affected  by  regulatory  practices,  rendering  useless  any  attempt  to  halt  their 
spread  outside  the  reach  of  American  law  enforcement. 


_ , ''  News  Reports  Confirm  PSI  TECH's  Radiological  'Dirty  Bomb'  Scenario  as  Possible  Terrorist 

Weapon,"  PSI  TECH  International,  Incorporated,  4  December  2001  [online];  available  from 
<http://www.remoteviewing.com/news/120401.html>  (accessed  19  December  2001). 

Mike  Boettcher  and  Ingrid  Arnesen, "  A1  Qaeda  Documents  Outline  Serious  Weapons  Program,"  CAW, 
25  January  2002  [online];  available  from  <http://www.cnn.eom/2002/US/01/24/inv.al.qaeda.documents/> 
(accessed  28  January  2002). 

David  Ruppe,  "Terror  Manual,"  ABC  News,  18  September  2001  [online];  available  from 
<http://abcnews.go.eom/sections/world/DailyNews/binladenterror_000918.html>  (accessed  5  October 
2001). 
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Chapter  Four:  Ubiquitous  Source  Of  Funding 


A  terrorist  organization,  like  any  other  entity,  requires  resources  to  conduct  operations; 
obviously,  the  greater  the  pool  of  resources  from  which  it  can  draw,  the  greater  its  capability  to 
act.  As  President  George  W.  Bush  remarked  shortly  after  the  second  attack  on  the  World  Trade 
Center,  "money  is  the  life-blood  of  terrorist  operations."^’  Information  technology  and  the 
Internet  are  providing  terrorist  organizations  with  new,  lucrative  sources  of  funding  in  their 
ongoing  efforts  to  finance  larger,  more  destmctive,  and  more  politically  significant  operations. 
This,  combined  with  various  techniques  available  on  the  Internet  to  launder  funds  derived  from  a 
variety  of  sources,  is  therefore  cause  for  some  measure  of  genuine  concern.  The  ability  to 
instantaneously  and  globally  transfer  funds  is  one  of  the  features  that  make  information 
technologies  so  useful  and  responsive  to  business  and  consumer  demands;  indeed,  it  is  one  of  the 
strengths  of  an  information-based  economy.  Ironically,  the  various  methods  of  funds  transfer 
available  today  also  provide  terrorist  organizations  with  the  same  connectivity  advantages  that 
individuals,  businesses  and  government  agencies  enjoy.  The  use  of  these  sources  of  funding  by 
paramilitary  and  extremist  groups  on  the  Internet,  including  terrorist  organizations,  runs  the 
gamut  from  conspicuous  marketing  campaigns  to  clandestine  money  laundering  efforts. 

Direct  Solicitation  of  Funds 

Some  of  these  groups,  for  example,  have  an  unabashed  presence  on  the  Internet;  they  openly 
declare  their  purposes  and  policies,  and  solicit  funds  for  their  operating  expenses  from  like- 
minded  individuals  and  groups,  all  in  plain  sight.  For  example,  the  African  People's  Socialist 
Party  (a.k.a.  International  People's  Democratic  Uhum  Movement)  has  a  web  site  at 
http://www.npdum.com,  which  contains  a  printable  page  individuals  can  use  to  pledge  monthly 

_ ,  "Bush  Calls  Halt  to  Terror  Funding,"  BBC  News,  24  September  2001  [online];  available  from 

<http://news.bbc.co.uk/hi/english/world/americas/newsid_1560000/1560942.stm>  (accessed  3  October 
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donations  in  a  manner  similar  to  Combined  Federal  Campaign  contributions.^*  The  Lebanese 
Forces  Party's  web  site,  at  http://www.lebanese-forces.org,  has  an  online  store  where  contributors 
can  purchase  books,  CDs,  clothing,  flags  and  other  paraphernalia.*®  The  Liberation  Tigers  of 
Tamil  Eelam,  commonly  referred  to  as  Tamil  Tigers,  also  have  an  online  store  at 
http://www.eelamweb.com,  although  donors  are  instructed  to  send  a  certified  check  or  money 
order  to  an  address  in  Canada,  payable  to  the  World  Tamil  Movement.®”  The  World  Church  of 
the  Creator,  a  white  supremacist  group  based  in  Illinois,  also  has  a  Web  site  at 
http://www.wcotc.com/index.shtml,  which  includes  a  PayPal  link  for  donations.  The  site  also  has 
an  online  store  where  donors  can  purchase  literature,  clothing,  membership  materials,  audio  and 
video  merchandise,  and  even  portraits  of  the  group's  founder.®* 

The  proliferation  and  ease  of  use  of  e-mail  also  provides  terrorist  groups  the  option  to  use 
commercial  "spam"  to  generate  income.  As  more  individuals  get  connected  to  the  Internet,  the 
potential  pool  of  online  donors  grows  commensurately.  For  example,  the  total  number  of  Internet 
users  worldwide  grew  to  almost  309  million  in  January  2002,  with  U.S.  users  accounting  for 
nearly  fifty  eight  percent  of  that  number.®*  Of  all  Internet  activity,  e-mail  is  the  most  widely  used 
Internet  resource  among  U.S.  citizens;  one  research  firm  estimates  that  forty  five  percent  of 
Americans  use  e-mail  regularly.®*  Also,  Internet  use  is  growing  in  the  U.S.  by  about  two  million 
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new  users  per  month.  As  Internet  user  demographics  become  clearer  and  better  defined, 
terrorist  groups  -  either  themselves,  or  through  proxies  with  plausible  deniability  -  will  be  able 
to  target  those  users  who  have  demonstrated  sympathy  or  sensitivity  to  certain  particular  causes 
or  social  issues,  and  solicit  private  donations  from  individuals  fitting  the  right  "profile"  whenever 
they  desire.  It  is  reasonable  to  conclude,  therefore,  that  they  will  account  for  at  least  a  portion  of 
worldwide  commercial  e-mail  volume.  When  coupled  with  effective  misinformation  or 
disinformation  about  the  tme  purposes,  goals,  and  activities  of  a  particular  group,  commercial  e- 
mail  solicitations  have  the  potential  to  contribute  significantly  to  a  terrorist  organization's 
publicity  objectives,  as  well  as  their  finances. 

Use  of  Private  Organizations  as  Fronts 

While  some  groups  conduct  their  Internet  activities  openly,  other  organizations  are  known  or 
suspected  of  using  charities,  legitimate  or  illegitimate,  as  fronts  for  their  financing.  An  overall 
decrease  in  visible  state-sponsored  terrorism  has  resulted  in  a  greater  proportion  of  terrorist 
support  coming  from  the  general  public.  In  fact,  “public  support  for  terrorist  groups  has  become 
the  most  essential  element  in  fund-raising  and  the  main  source  of  finances,”"^^  despite  the  fact  that 
the  general  public  is  not  always  aware  of  the  ultimate  recipients  of  their  money  The  well- 
publicized  investigation  of  the  Holy  Land  Foundation  for  Relief  and  Development  (HLFRD),  and 
the  subsequent  seizure  of  its  assets,  was  only  one  of  numerous  actions  taken  by  the  Bush 
administration  in  the  wake  of  the  World  Trade  Center  attack  to  disrupt  alleged  financing  schemes 
of  this  sort.  One  alarming  revelation,  according  to  a  Federal  Bureau  of  Investigation 
memorandum,  was  the  use  of  charitable  donations  to  fund  annuities  for  the  families  of  Hamas 
suicide  bombers  in  Israel  and  Palestine.  Allegedly,  HLFRD's  support  provides  "a  constant  flow 
of  suicide  volunteers  and  buttresses  a  terrorist  infrastructure  heavily  reliant  on  moral  support  of 
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the  Palestinian  populace."^®  At  one  time  the  HLFRD  had  a  Web  site,  but  as  of  this  writing  it  is  no 
longer  available'*’. 

Benevolence  International  Foundation'**  and  Global  Relief  Foundation'*®,  whose  assets  were 
also  frozen  in  December  2001,  continue  to  operate  online  and  have  pages  providing  numerous 
tools  for  potential  donors,  including  online  donation  by  credit  card,  wire  transfer,  online 
checking,  and  other  methods.  The  International  Islamic  Relief  Organization,  allegedly  founded 
by  Usama  bin  Laden's  brother-in-law,  has  a  continuing  presence  on  the  Internet °.  Ostensibly, 
this  organization  was  created  to  "alleviate  the  suffering  of  human  beings  worldwide,"  and 
conducts  "humanitarian  activities  in  more  than  120  countries  in  different  parts  of  the  world.  Its 
web  site  provides  a  mailing  address  in  Saudi  Arabia,  as  well  as  an  e-mail  address  and  voice,  FAX 
and  TELEX  numbers,  but  the  site  itself  does  not  specifically  solicit  private  donations. 

Abuse  of  Unregulated  Modes  of  Funds  Transfer 

As  pervasive  as  open  and  direct  forms  of  online  solicitation  are,  even  when  using  a 
legitimate-appearing  front,  some  terrorist  groups  may  choose  to  maintain  a  more  clandestine 
presence  on  the  Internet.  Since  the  e-commerce  industry  in  general  is  as  yet  largely  unregulated, 
there  are  several  Internet  avenues  that  are  susceptible  to  terrorist  manipulation  for  funds  transfer, 
money  laundering,  and  illicit  exchange  schemes.  Online  auction  providers  such  as  eBay  or 
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Yahoo!  Auctions,  for  example,  may  unwittingly  provide  the  means  for  terrorist  and  other  criminal 
organizations  to  transfer  funds  while  attracting  little  or  no  unwanted  attention  to  their  activities. 
The  author's  research  into  eBay  auctions,  for  example,  revealed  numerous  instances  of  attempted 
sales  of  online  video  game  accounts,  or  the  copyrighted  material  therein.  Frequently,  attempted 
sales  were  disguised  as  a  different  offer  entirely  using  ingenious  legal  or  semantic  devices.  One 
such  auction  offered  a  set  of  second-hand  video  game  software  for  $200.00,  which  was  available 
brand-new  from  the  publisher  for  $39.99.^^  Although  this  particular  transaction  by  itself  is  not 
illegal,  closer  inspection  of  the  terms  of  the  offer  revealed  that  the  seller  was  in  fact  attempting  to 
sell  the  game  characters  that  he  had  created  and  advanced  during  his  time  playing  the  game,  in 
violation  of  copyright  law  and  the  end  user  license  agreement  accompanying  the  software.^^ 

While  copyright  infringement  is  hardly  as  serious  a  transgression  as  terrorist  financing,  this 
example  illustrates  how  disreputable  individuals  and  groups  can  exploit  a  pervasive,  unregulated 
Internet  economy.  Terrorist  operatives  can  open  an  account  with  an  online  auction  provider,  offer 
any  item  at  all  -  a  motor  vehicle,  a  coin  collection,  or  even  a  cookie  recipe,  to  cite  a  ridiculous 
example  -  and  "sell"  it  to  a  tmsted  agent  who  knows  where  to  look  for  this  particular  item. 
Whether  actual  goods  or  services  are  delivered  after  the  electronic  exchange  takes  place  is 
immaterial;  the  important  point  is  that  the  funds  are  transferred.  The  advantage,  then,  of  using  an 
unregulated  online  auction  provider  is  that  nobody  need  know  exactly  what  goods  or  services 
changed  hands,  or  if  in  fact  anything  other  than  cash  changed  hands  at  all.  Lost  in  the  huge 
volume  of  daily,  anonymous  transactions,  moderately  sized  parcels  of  cash  can  thus  easily  be 
transferred  and  effectively  laundered  by  anyone  with  an  Internet  connection. 
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International  electronic  payments  between  legitimate  businesses  have  been  available  for  a 
number  of  years  through  a  variety  of  official  and  unofficial  organizations,  such  as  the  Society  for 
Worldwide  Interbank  Financial  Telecommunication.  With  the  increasing  popularity  of  the 
Internet  and  development  of  financial  services  networks  outside  of  the  conventional  banking 
industry,  it  has  become  easier  than  ever  for  individuals,  charities  and  small  businesses  to  collect 
and  disburse  funds  elechonically.  Acting  as  fronts  for  terrorist  organizations,  any  of  these  entities 
can  easily  exploit  such  networks  to  push  resources  when  and  where  they  are  needed  to  finance 
terrorist  operations.  Depending  on  local  and  national  laws,  such  transactions  can  prove  to  be 
virtually  untraceable.  For  example,  numerous  countries  permit  the  existence  of  anonymous 
corporations  and  shell  banks  that  are  completely  unregulated  and  in  some  cases  immune  to 
foreign  prosecution.  Even  in  a  country  like  America,  with  fairly  robust  banking  laws,  online 
financial  services  provide  opportunities  for  funds  transfer  and  money  laundering.  One  company 
known  as  PayPal,  for  example,  has  a  network  of  over  twelve  million  registered  users  who  use  the 
system  to  make  payments  on  online  auction  and  other  e-commerce  sites,  as  well  as  for 
professional  services  rendered.^'’  Again,  since  this  industry  is  as  yet  unregulated,  the  potential  for 
exploitation  by  criminal  entities  is  very  real. 

Shortly  after  the  World  Trade  Center  attacks,  the  Organisation  For  Economic  Co-Operation 
And  Development's  Einancial  Action  Task  Eorce  recognized  serious  deficiencies  in  anti-money 
laundering  procedures  within  the  international  banking  system  and  adopted  eight 
recommendations  designed  to  thwart  terrorist  fund  raising  and  distribution.  Although  the 
recommendations  are  non-binding,  they  illushate  that  the  international  community  is  only 
beginning  to  perceive  the  relative  ease  with  which  criminal  entities  are  able  to  conduct  all  kinds 
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of  transactions  in  today's  global,  electronic  financial  environment,  as  well  as  the  potential 
difficulties  to  be  encountered  in  responding  to  the  problem. 
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Chapter  Five:  Offensive  Information  Operations 


Terrorist  offensive  information  operations^®  can  take  many  forms,  including  but  not  limited  to 
1)  attacks  on  the  information  system  itself,  in  the  form  of  physical  or  cyber  attack  of  critical 
communications  nodes;  2)  cyber  attacks  against  control  systems  for  critical  parts  of  national 
infrastructure,  resulting  in  varying  degrees  of  physical  damage,  and  3)  psychological  attacks  on 
individuals  and  groups.  The  Internet's  pervasiveness  and  interconnectivity  results  in  difficult  to 
manage  vulnerabilities  that  terrorists  can  and  do  seek  out.  Moreover,  the  widespread  availability 
of  potentially  disruptive  dual-use  software  facilitates  terrorist  offensive  information  operations. 

Internet  Vulnerability 

The  vulnerability  of  the  Internet  was  probably  not  foreseen  at  its  creation,  for  a  number  of 
reasons.  Originally,  the  Internet  was  designed  to  enhance  information  sharing  among  a  select 
group  of  trusted  users.  Indeed,  its  open  architecture,  which  creates  its  susceptibility  to 
exploitation,  has  always  been  an  intentional  feature.  The  more  porous  the  medium,  the  more 
rapidly  it  can  disseminate  information;  or,  as  stated  succinctly  by  one  observer,  "part  of  the 
difficulty  in  securing  the  Internet’s  infrastructure  and  protecting  it  from  ancillary  attacks  lies  in  its 
structure,  which  was  designed  to  facilitate  communication,  not  thwart  invaders. The  Internet 
continues  to  be  a  soft  terrorist  target,  despite  advances  in  computer  network  security,  because  it 
remains  vulnerable.  The  National  Security  Agency,  in  its  series  of  "Eligible  Receiver"  exercises 
in  1996,  noted  that  almost  two-thirds  of  all  federal  government  computers  systems  were  not 
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secure  Although  some  progress  has  been  made  since  then  in  improving  Internet  and  computer 
security  in  both  the  public  and  private  sectors,  the  news  is  not  entirely  good.  The  CERT 
Coordination  Center,  for  example,  provides  several  indicators  of  Internet  vulnerability  to  hacking 
or  other  malicious  activity;  their  most  recent  report  indicates  the  number  of  annual  Internet 
security  incidents  grew  exponentially  from  1988  to  2001.  The  Internet  thus  continues  to  be 
vulnerable  to  terrorist  offensive  information  operations. 

Attacks  on  the  Information  System 

Despite  its  vulnerabilities,  the  Internet  is  a  robust  system  in  that  it  is  "self-healing."  Because 
the  Internet  is  networked,  information  can  follow  a  variety  of  paths  and  thus  circumvent 
discontinuities  in  the  system,  irrespective  of  whether  they  are  intentionally  caused.  While  this 
characteristic  is  one  of  the  Internet's  great  strengths,  there  are  nonetheless  critical  system  nodes 
that  are  susceptible  to  cyber  attack,  and  the  disruption  or  destruction  of  these  nodes  can  cause 
widespread  loss  of  connectivity.  In  a  1998  report  on  Internet  vulnerabilities,  the  director  of 
education  for  the  International  Computer  Security  Association  stated  that  "when  you  attack  a 
network  you  can  attack  the  channels,  but  the  channels  are  multiple  in  the  Net . . .  but  you  can  also 
attack  the  control  structures  that  determine  things  like  addressing  and  how  information  gets 
transferred  through  the  Net.  And  in  those  circumstances,  I  think  you  have  a  real  problem."®^  One 
example  of  this  type  of  attack  involves  targeting  routers,  domain-name  servers  and  other 
information  hubs  with  denial-of-service  attacks.  If  properly  orchestrated  and  coordinated,  these 
types  of  attacks  can  bring  the  entire  Internet  down  for  a  short  period  of  time. 
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The  Internet  is  susceptible  not  only  to  cyber  attack,  but  also  to  physical  attack.  If  the  targets 

are  selected  carefully,  physical  attacks  can  in  fact  achieve  even  more  dramatic  results  than  cyber 

attacks.  A  relatively  small  number  of  well-placed  bombs  could  achieve  significant  dismption  if 

the  attacker  knows  where  to  strike,  and  does  so  in  a  coordinated  manner  against  multiple  targets 

simultaneously.  The  widespread  use  of  fiber  optic  cable,  while  vastly  increasing  the  rate  of  data 

transmission  on  the  Internet,  creates  a  similar  physical  vulnerability: 

One  of  the  hardest  attacks  to  guard  against  is  the  low-tech  approach  -  known  in  security 
circles  as  the  “backhoe  attack.”  “Just  go  in  and  cut  the  fiber  [optic  cable]  . . .  most  of  the 
domestic  Internet  and  all  of  Europe  is  connected  [at  an  Internet  exchange  point  in 
Virginia],  so  you  could  wipe  out  everything  for  days.  If  you  cut  several  times  in  several 
different  places,  you  could  wipe  it  out  for  weeks.®"^ 

This  continuing  vulnerability,  moreover,  is  taking  place  in  an  environment  where  the  hacker's 
knowledge  base  and  tool  kit  are  becoming  increasingly  more  available  to  anyone  with  access  to 
an  Internet  connection.  For  example,  in  April  1999  there  were  an  estimated  30,000  web  sites 
devoted  to  hacking;  many  of  these  sites  allow  users  to  download  dismptive  utilities  and  other 
software,  as  well  as  provide  a  fomm  for  discussion  of  hacking  tips  and  techniques.®^  In  an  article 
about  the  potential  for  cyber  terrorism  on  the  Internet,  computer  security  expert  Rob  Clyde 
commented  that  "you  no  longer  have  to  have  knowledge,  you  just  have  to  have  the  time  . . .  you 
just  download  the  tools  and  the  programs.  It's  the  democratization  of  hacking.  And  with  these 
programs  . . .  they  can  click  on  a  button  and  send  [virtual]  bombs  to  your  network,  and  the  systems 
will  go  down."®® 

Cyber  Attacks  on  Critical  Control  Systems 

Despite  the  challenges  and  unnecessary  costs  posed  by  the  cyber  threat  to  the  Internet  itself, 
potential  attacks,  even  if  well  orchestrated,  are  merely  nuisances  in  the  long  term.  Defacement  of 
public  Web  sites  is  certainly  little  more  than  electronic  graffiti,  while  taking  the  entire  system 

®'^  Ibid. 
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down,  even  for  an  extended  period  of  time,  would  constitute  at  worst  a  significant  disruption;  it  is 
unlikely  to  generate  mass  casualties,  for  example,  or  catastrophic  physical  or  economic  damage. 

In  any  event,  it  is  arguable  that  terrorist  groups  have  a  vested  interest  in  maintaining  rather  than 
disrupting  Internet  connectivity,  if  they  come  to  rely  upon  it  for  their  own  purposes.  Cyber 
attacks  on  critical  control  systems,  however,  are  much  more  potentially  devastating,  and 
achievable  without  disruption  to  the  Internet  at  large.  As  Vetter  and  Perlstein  have  pointed  out, 
advanced  industrial  societies  may  have  unforeseen  vulnerabilities  associated  with  weak  nodes  in 
their  technological  infrastmctures,  or  with  the  complexity  and  interdependence  of  the  systems 
themselves.  Attacks  on  these  vulnerabilities,  even  by  a  small  group  of  determined  terrorists  with 
the  requisite  expertise,  "could  have  far-reaching  consequences."*’’ 

Much  of  the  current  concern  in  the  area  of  critical  control  systems  lies  in  a  type  of  software- 
facilitated,  distributed  control  system  known  as  a  Supervisory  Control  and  Data  Acquisition 
(SCADA)  system.  SCADA  software  is  used  in  computer  networks  to  control  and  monitor 
machines  and  other  equipment  in  a  variety  of  industrial  settings,  including  electrical  power 
production  and  distribution,  water  treatment  and  distribution,  manufacturing,  petroleum 
exploration  and  drilling,  and  nuclear  energy  applications.  The  software  accesses  data  about  the 
state  of  actuators,  valves,  motors,  electrical  relays,  and  other  machine  components,  and  can  in  fact 
be  used  to  control  these  devices  remotely  over  a  wide  geographical  area.  Additionally,  it  is  used 
to  report  alarm  or  emergency  conditions  extant  in  industrial  equipment,  and  make  that 
information  available  for  access  to  any  or  all  client  computers  on  the  network.*’*  The  chief  utility 
of  SCADA  systems  is  that  they  allow  personnel  to  monitor  and  control  equipment  distributed 
over  a  large  area  or  in  remote  locations  from  a  convenient  central  facility,  reducing  administrative 
and  logistical  costs. 

Ibid. 

Harold  J.  Vetter  and  Gary  R.  Perlstein,  Perspectives  on  Terrorism  (Pacific  Grove,  California: 

Brooks/Cole  Publishing  Company,  1991),  p.  181. 

_ ,  ''What  is  SCADA,"  Modular  SCADA  Limited,  no  date  [online];  available  from 
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The  very  convenience  that  makes  SCADA  systems  efficient,  however,  also  creates 
vulnerabilities.  While  usually  deployed  on  a  closed,  isolated  local  area  network  for  security 
reasons,  some  studies  show  they  are  being  connected  to  the  Internet  at  large  with  greater 
frequency,  mostly  due  to  remote  access  constraints  and  corporate  information  demands.'’® 
Additional  vulnerabilities  can  arise  from  too  much  information  about  the  network  being  available 
to  the  general  public,  insecure  network  architecture,  lack  of  fully  enforceable  security  protocols, 
or  poor  security  management  practices.’® 

The  chief  threats  posed  by  hacking  into  SCADA  networks  include  disrupting  or  completely 
shutting  down  electrical  power  grids,  water  treatment  and  distribution,  and  other  industrial 
processes.  It  is  also  possible  to  alter  or  mask  valid  emergency  alarms  in  industrial  equipment. 
Failing  to  recognize  an  emergency  condition,  operators  might  not  perform  the  appropriate 
emergency  procedures,  thus  allowing  the  emergency  condition  to  worsen  before  it  is  detected  and 
corrected;  ultimately,  it  might  by  then  be  too  late  to  prevent  serious  damage,  personal  injury  or 
deaths.  An  even  more  threatening  scenario,  however,  might  involve  making  one  type  of 
condition  display  as  an  alarm  for  a  completely  different  emergency  situation:  in  this  case,  an 
operator  who  reacts  with  an  incorrect  emergency  procedure  might  compound  the  problem  rather 
than  solve  it. 

Psychological  Attacks^^ 

While  terrorist  information  attacks  directly  against  the  Internet  and  other  U.S.  infrastructure 
are  indeed  potentially  formidable,  the  worst  long-term  damage  may  be  psychological  -  either 


<http://www.modular-scada.co.uk/what-is-scada.htm>  (accessed  30  November  2001). 
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The  psychological  impact  of  terrorist  information  operations,  while  emphasized  in  this  chapter,  is  equally 
pertinent  to  terrorist  publicity  concepts.  See  Chapter  Six,  Publicity. 
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from  the  psychological  effects  of  physical  attacks,  or  via  the  effects  of  purely  psychological 
attacks.  Hoffman  has  found  that  terrorist  acts  almost  always  seek  to  convey  a  message;  the  more 
shocking  and  frightening  the  terrorist  act,  the  greater  the  impact  of  the  message.’^  In  this  process, 
which  seeks  to  influence  domestic  and  international  public  opinion,  terrorist  psychological  attacks 
can  also  inflict  significant  damage  on  the  U.S.  and  global  economy,  for  a  relatively  small 
investment  of  resources.  The  psychological  effects  of  physical  attacks,  for  example,  can 
potentially  be  more  damaging  than  the  initial  violence.  In  some  cases,  the  intended  effect  of  a 
physical  attack  can  be  more  psychological  than  physical,  while  other  types  of  attacks,  especially 
those  enabled  or  accomplished  through  means  of  information  technology,  are  almost  purely 
psychological. 

The  terrorist  attacks  on  the  World  Trade  Center  and  other  targets  on  September  11,  2001  had 

demonstrably  adverse  psychological  effects,  some  of  which  were  far  removed  from  the  actual 

scenes  of  violence.  Charles  Marmar,  professor  and  vice  chair  of  the  department  of  psychiatry  at 

the  University  of  California  at  San  Francisco,  and  associate  chief  of  staff  at  the  San  Francisco 

Veterans  Affairs  Medical  Center,  estimated  that  between  70,000  and  100,000  people  in  New 

York  City  alone  were  at  high  risk  for  post-traumatic  stress  disorder,  by  observing  the  destruction 

from  a  nearby  vantage  point,  by  losing  a  relative  or  close  friend  in  the  disaster,  or  due  to  other 

factors.  The  psychological  costs  of  9/1 1  could  ultimately  rival  its  physical  destruction: 

Before  the  terrorist  attacks  on  the  World  Trade  Center  and  the  Pentagon,  anxiety-related 
disorders  cost  the  U.S.  $42  billion  a  year  in  medical  and  work-related  losses.  Now  mental 
health  professionals  can  only  make  educated  estimates  of  how  many  more  of  us  will  be 
affected  in  the  near  future,  although  they  have  begun  studying  the  problem. 

A  similar  phenomenon  can  be  observed  with  the  intentional  placement  of  anthrax-laced 

letters  within  the  U.S.  mail  system.  This  incident,  following  almost  on  the  heels  of  the  9/1 1 

attacks,  has  been  referred  to  as  a  "scare"  with  good  reason:  with  no  disrespect  to  those  American 

Bruce  Hoffman,  Inside  Terrorism  (New  York:  Columbia  University  Press,  1998),  p.  131. 

Sarah  Graham,  ''9/11:  The  Psychological  Aftermath,"  Scientific  American,  12  November  2001  [online]; 
available  from  <http://www.sciam.eom/explorations/2001/l  1 1201  anxiety />  (accessed  13  December  2001). 
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innocents  who  were  affected,  the  primary  effect  of  the  anthrax  release  was  psychological.  Dr 
John  Gearson,  senior  lecturer  in  defense  studies  at  King's  College,  London,  put  the  threat  of  such 
biological  attacks  in  perspective,  dismissing  its  physical  dimension  while  highlighting  its 
psychological  potency: 

The  anthrax  scare  continues  to  grow  and  around  the  world  people  feel  more  vulnerable  than 
at  any  time  since  the  height  of  the  Cold  War  as  they  face  the  threat  of  bio-chemical  terrorist 
attack.  Government  officials  stmggle  to  reassure  the  public,  while  conflicting  and  lurid 
reports  from  an  excited,  and  directly  targeted,  media  do  little  to  calm  the  situation.  . . .  But  we 
are  not  particularly  good  at  risk  assessment  at  the  best  of  times  and  this  should  caution  us  in 
the  current  climate  of  fear  and  uncertainty.  In  the  two  weeks  since  the  anthrax  scare  began  to 
sweep  the  USA  more  than  a  thousand  Americans  have  died  in  car  accidents,  but  the  roads 
have  not  been  shut  down. 

It  is  clear  that  both  of  these  recent  attacks  have  caused,  if  not  fear,  at  least  serious  concern 
among  U.S.  citizens.  The  mere  threat  of  another  September  1 1 -style  incident  was  enough  to 
reduce  airline  passenger  miles  significantly,  thus  weakening  major  airlines  and  the  U.S.  economy 
in  general:  airline  revenues  after  9/1 1  dropped  from  almost  $33  billion  to  just  over  $20  billion,  a 
decrease  of  approximately  thirty  eight  percent.^^  The  threat  of  biological  terrorism  likewise 
sparked  more  than  a  100  percent  increase  in  traffic  to  the  Centers  for  Disease  Control  and 
Prevention  Web  site;  in  October  2001,  it  registered  more  than  9.1  million  unique  "hits,"  the  most 
of  any  Federal  government  site  in  that  time  frame.’® 

The  power  of  the  Internet  to  inculcate  fear  is  not  limited,  however,  to  its  ability  to  facilitate 
and  create  synergy  with  lethal  physical  attacks.  Terrorists  can  also  use  information  technology  to 
communicate  frightening  messages  without  any  specific  linkage  to  a  physical  act  of  desfruction. 
Even  if  such  messages  do  not  create  widespread  panic,  they  can  result  in  significant  economic 
costs  to  Internet  users  and  providers.  One  example  is  the  use  of  e-mail  hoaxes  to  spread 
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disinformation,  in  an  attempt  to  create  widespread  panic.  The  virtue  of  e-mail  hoaxes  is  they  can 
be  targeted  precisely  at  specific  organizations.  The  U.S.  Department  of  Energy,  on  its  Computer 
Incident  Advisory  Capability  Web  site,  lists  a  variety  of  e-mail  hoaxes  targeted  against  such 
disparate  organizations  as  the  U.S.  government,  commercial  fast-food  chains,  discount  store 
chains,  and  other  entities.  Although  the  likelihood  of  widespread  panic  resulting  from  an  e-mail 
hoax  is  probably  not  high,  the  costs  in  lost  time  and  bandwidth  can  range  in  the  millions  of 
dollars.’^ 


U.S.  Department  of  Energy,  Computer  Incident  Advisory  Capability,  "CIAC  Internet  Hoax  Information," 
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Chapter  Six:  Publicity 


Terrorists  use  a  variety  of  techniques  to  broadcast  their  message.  Usually,  this  is  because 
they  wish  to  be  seen  not  as  criminals,  but  as  liberators,  or  other  instigators  of  positive  change. 
Clearly,  depending  on  one's  point  of  view,  terrorist  organizations  can  be  seen  in  either  light; 
hence,  it  has  been  stated  innumerable  times  that  "one  man's  terrorist  is  another  man's  freedom 
fighter.  At  least  in  part  because  of  this  problem  -  which  is  essentially  one  of  perspective  - 
scholars  have  repeatedly  encountered  difficulty  in  defining  terrorism.  Still,  there  is  general 
agreement  that  terrorists  usually  have  a  political,  cultural  or  religious  agenda  they  wish  to 
implement.  To  achieve  their  objectives,  moreover,  they  frequently  choose  actions  that  maximize 
their  visibility  in  the  media,  thereby  drawing  attention  to  the  cause  or  causes  they  espouse.  As 
Hoffman  asserts,  "without  the  media's  coverage  the  [terrorist]  act's  impact  is  arguably  wasted, 
remaining  narrowly  confined  to  the  immediate  victim(s)  of  the  attack  rather  than  reaching  the 
larger  'target  audience'  at  whom  the  terrorists'  violence  is  actually  aimed. 

To  this  end,  terrorists  have  historically  relied  very  heavily  on  organized  media,  including 
newspapers,  periodicals,  television,  and  radio,  to  communicate  their  motives  and  aims  in  what 
they  hope  to  be  positive  ways.  In  order  to  secure  favorable  publicity,  terrorist  groups  have 
frequently  attempted  to  form  "good  relationships  with  the  press  [that]  are  often  cultivated  and 
nurtured  over  a  period  of  years."*'  By  the  late  1990s,  however,  a  series  of  trends  had  developed 
that  was  beginning  to  affect  the  relationship  of  terrorists  and  the  media.  One  of  these  trends  is  the 
growing  incidence  of  terrorist  attacks  on  the  very  media  personnel  and  institutions  they  seek  to 
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influence.*^  One  explanation  of  this  seeming  contradiction  between  terrorist  ends  and  means  lies 
in  the  advent  of  the  Internet.  Legitimate  businesses  have  been  using  the  Web  to  build  awareness 
and  credibility  with  the  public  for  years;  with  little  investment,  terrorist  groups  can  now  do  the 
same,  and  are  working  harder  towards  developing  solid  online  presences  to  further  their  political 
ambitions.  As  the  Webmaster  of  the  Zapatista  Army  of  National  Liberation's  unofficial  site 
stated,  "the  crisis  in  Chiapas  will  not  be  solved  in  Cyberspace;  yet,  the  Internet  can  be  a  powerful 
tool  for  activism  and  information  dissemination  (hence,  the  page's  existence)."*^  Indeed,  terrorist 
organizations  can  arguably  affect  public  opinion  through  the  Internet  in  even  more  thoroughgoing 
ways  than  is  possible  using  conventional  print  or  broadcast  media. 

The  Internet  as  Terrorist  Publicity  Tool 

The  Internet  provides  some  benefits  to  terrorists  over  conventional  media  in  influencing 
public  perception  of  their  organizations  or  objectives.  For  example,  terrorist  Web  publishers  have 
complete  freedom  to  control  the  content  of  their  publicity;  they  need  not  depend  on  journalists  or 
editors  from  the  conventional  media,  upon  whom  they  cannot  necessarily  rely  not  to  misrepresent 
portions  of  the  message,  or  place  them  out  of  context.  To  a  lesser  extent,  they  can  also  determine 
which  "audience"  sees  what  content.  Current  versions  of  Web  browsers,  including  Netscape  and 
Internet  Explorer,  support  JavaScript  functions  allowing  Internet  servers  to  know  which  language 
is  set  as  the  default  for  a  particular  client's  computer.  Hence,  a  browser  set  to  use  English  as  the 
default  language  can  be  redirected  to  a  site  optimized  for  publicity  aimed  at  Western  audiences, 
while  one  set  to  use  Arabic  as  the  default  can  be  redirected  to  a  different  site  tailored  toward  Arab 
or  Muslim  sensibilities. 
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These  capabilities  allowing  editorial  discretion  and  customized  messages  based  on  the 
audience  affords  terrorists  great  flexibility  in  the  prosecution  of  their  information  war.  However, 
it  is  nonetheless  necessary  to  have  sufficient  numbers  of  personnel  properly  trained  in  required 
computer  skills  to  achieve  desired  Web  effects.  In  this  regard,  the  quality  of  terrorist  Web 
content  is  highly  variable;  in  some  cases,  Web  sites  sponsored  by  or  sympathetic  to  terrorist 
issues  are  amateurish  at  best,  but  professional  sites  with  high  production  values  are  becoming 
more  common.  Moreover,  terrorist  propaganda  on  the  Internet  can  be  overt,  such  as  on  "official" 
Web  sites  where  the  organization  itself  claims  responsibility  for  content,  or  covert,  such  as  on 
"unofficial"  sites  published  by  sympathetic  individuals  or  organizations  with  no  visible,  direct  ties 
to  the  terrorist  organization  itself.  Consequently,  at  least  some  terrorist  organizations  active  on 
the  Internet  appear  to  demonstrate  more  sophistication  and  sensitivity  to  particular  target 
audiences  than  might  be  commonly  appreciated.  That  is,  the  messages  and  images  they  contain 
may  vary  dramatically,  depending  on  the  target  audience. 

Examples  of  these  distinctions  abound  on  the  Internet.  The  official  Hamas  site  contains 
imperfections  typical  of  amateur  Web  publishing  efforts,  such  as  broken  links,  misspellings,  and 
HTML  "gizmos"  which  do  more  to  distract  than  draw  attention  to  important  topics*^.  Many 
documents  linked  to  this  site  portray  images  of  graphic  violence,  presumably  in  an  effort  to 
inspire  feelings  of  outrage.  The  OBM-Network  site  -  Internet  home  of  Al-Muhajiroun  leader 
Sheikh  Omar  Bakri  Muhammad  -  is  more  professionally  done  than  Hamas'  site,  although  broken 
links  are  also  evident  here.®'’  Multiple  links  from  this  site  and  its  sister  site,  Al-Muhajiroun,  also 
lead  to  documents  with  images  of  graphic  violence.®^  The  higher  end  of  Web  publishing 
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standards,  at  least  in  terms  of  aesthetics,  is  represented  by  the  Euskal  Herria  Journal  Web  site,*®  a 
New  York-based  publication  supporting  Basque  independence  with  links  to  Euskadi  Ta 
Askatasuna  (ETA).  This  site  does  not,  incidentally,  contain  images  of  graphic  violence. 

Although  it  is  impossible  to  divine  intent  from  a  survey  of  Web  sites  alone,  it  is  safe  to  state 
that  terrorist  propaganda  on  the  Web  takes  many  forms,  and  can  be  tailored  to  a  variety  of 
audiences.  Eor  example,  content  can  be  targeted  specifically  at  those  who  are  already  "tme 
believers":  that  is,  those  whose  perception  of  the  organization  is  already  positive,  whose 
perception  of  the  "enemy"  is  already  negative,  or  both.  Propaganda  on  such  sites  can  be  intended 
to  reinforce  that  belief.  On  other  sites,  content  can  be  oriented  more  toward  persuading 
"unbelievers"  of  the  correctness  of  the  terrorists'  point  of  view.  Although  inducing  a  radical 
change  of  belief  on  the  part  of  an  opponent  would  obviously  be  beneficial,  the  chief  benefit  from 
these  sites  would  be  convincing  the  "fence-sitters":  those  who  have  not  formed  an  opinion,  or 
who  have  mixed  feelings  about  issues  important  to  the  terrorists.  Eor  example,  it  may  be  easier  to 
persuade  educated  Western  audiences  with  facts  rather  than  with  imagery.  If  the  goal  is  to  recruit 
suicide  bombers,  images  of  graphic  violence  interspersed  with  half-tmths  and  religious  dogma 
may  be  more  appropriate. 

The  Internet  as  Terrorist  Recruiting  Tooi 

Although  publicity  is  in  part  image-creation  and  image-maintenance,  it  also  involves 
gamering  active  support  for  the  terrorist  organization  and  its  objectives.  Whereas  conventional 
media  has  and  will  continue  to  supply  avenues  for  the  first  two,  the  Internet  allows  terrorist 
organizations  to  solicit  and  receive  support  directly  from  its  online  audience.  Its  "always  on" 
nature,  as  well  as  its  ability  to  present  unadulterated  content  to  specific  audiences,  makes  the  Web 
an  attractive  choice  as  a  terrorist  recmiting  tool. 

contains  graphic  pictures  of  children  in  Iraq  with  horrible  birth  defects:  blamed,  of  course,  on  the  United 

States  and  United  Kingdom. 
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Although  a  central  Internet  clearinghouse  for  terrorist  recruitment  -  the  "Monster.com"  of 
terrorism,  so  to  speak  -  does  not  yet  exist,  some  extremist  organizations  already  exploit  the 
technology  specifically  for  this  purpose  on  their  official  Web  sites.  A  2001  study  on  Internet 
extremist  group  recruitment  found  that,  although  they  have  achieved  only  modest  success,  hate 
groups  such  as  the  Hammerskin  Nation,  the  National  Alliance,  Stormfront,  Aryan  Nations,  and 
the  Word  Church  of  The  Creator  are  all  interested  in  using  the  Web  for  recruiting  members, 
including  proselytizing  minors.*^  Other  radical  or  extremist  groups  or  their  political  analogs  also 
recruit  actively  on  the  Web.  For  example,  the  African  People's  Socialist  Party  Web  site  contains 
a  page  providing  instmctions  for  gaining  membership,  sponsoring  new  members,  and  creating 
local  chapter  affiliates. Sinn  Fein's  Web  site  not  only  encourages  people  to  join  local  or 
regional  branches  of  Sinn  Fein  internationally,  but  also  provides  an  e-mail  newsletter  service.^* 
The  Lebanese  Forces  Party  has  recently  solicited  volunteers  to  serve  as  French  translators  for  its 
Web  site,  as  well  as  managers  for  its  advertising,  forums,  and  links  areas.^^ 

Another  popular  recmiting  aid  for  terrorist  groups  has  been  videotapes,  as  evidenced  by 
recent  discoveries  of  bmtally  graphic  recruiting  tapes  in  conventional  formats.^^  As  digital  video 
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recording  devices  become  less  expensive,  digital  "tapes"  can  easily  supplant  old-fashioned  analog 
tapes,  simply  because  digital  video  files  are  easier  to  distribute.  Digital  formats  such  as  Windows 
Media  Player,  Real  Player,  and  QuickTime  are  more  accessible  because  the  Internet  does  not 
recognize  international  boundaries.  In  countries  with  freedom  of  speech  laws,  it  is  very  difficult 
to  quash  distribution  of  such  content  on  the  Internet,  however  illegal  or  unsavory  the  subject 
matter.  Distribution  of  digital  video  is  thus  more  resistant  to  interception  efforts  by  state 
agencies,  as  well  as  more  available  in  general,  since  anyone  with  an  Internet  connection  can 
download  the  relevant  content.  Moreover,  technology  also  exists  for  reformatting  conventional 
recruiting  videotapes  into  Internet-friendly  formats  for  Web  publication  or  electronic  transfer.  A 
number  of  different  software  utilities  facilitate  conversion  of  VHS  and  other  conventional  formats 
to  digital  files  recognizable  by  computer  video  applications,  including  Adobe's  Premiere  6.0; 
thus,  conversion  and  electronic  distribution  of  current  and  future  terrorist  recruiting  tapes  is 
possible  now,  for  relatively  small  investment  of  resources.^"^ 
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Chapter  Seven:  Conclusions  And  Recommendations 


Terrorist  organizations  can  use  the  Internet  and  related  information  technology  in  a  variety  of 
ways  to  achieve  their  purposes.  They  can  exercise  command,  control  and  communications  over 
global  distances,  in  real  time,  and  often  with  considerable  security.  They  can  effectively 
coordinate  among  individual  cells,  taking  full  advantage  of  the  strengths  of  a  networked 
organization.  They  can  even  coordinate  with  other  groups,  such  as  rogue  states,  like-minded 
terrorist  organizations,  and  sympathetic  nongovernmental  organizations,  to  achieve  enhanced 
synergy  in  their  operations.  They  can  solicit  donations,  as  well  as  move  and  launder  funds.  They 
can  collect  and  distribute  intelligence,  technical  data,  doctrine,  tactics,  and  procedures.  They  can 
conduct  offensive  information  operations,  including  psychological  operations,  physical  and  cyber 
attacks  against  friendly  C4I  systems  and  nodes,  and  cyber  attack  and  exploitation  of  critical  state 
infrastructure  that  is  heavily  dependent  on  computer,  and  especially  Internet,  technology.  All  of 
these  capabilities  transcend  international  boundaries,  and  are  frequently  difficult  to  fight  directly, 
particularly  in  nations  with  freedom  of  speech  laws.  Indeed,  each  of  them  capitalizes  on  the 
porous  nature  of  liberal,  democratic  societies,  as  well  as  their  increasing  dependence  on 
information  technology  in  the  normal,  day-to-day  course  of  human  affairs.  Simply  put,  current 
information  technology  enables  terrorists  to  practice  netwar,  and  affords  them  unprecedented 
freedom  of  action. 

Meeting  the  challenge  of  these  threats  is  not  going  to  be  simple,  inexpensive,  or  painless. 

The  war  on  terrorism  will  likely  be  long,  as  well  as  arduous;  indeed,  there  may  be  no  way  to  win 
the  war  on  terrorism  decisively.  The  paradigm  of  conflict  has  shifted  away  from  confrontation 
between  monolithic  nation-states,  and  towards  smaller,  nastier  wars  between  a  variety  of  regional, 
national  and  sub-national  participants.  Network  centric  warfare  blurs  the  distinction  between 
military  and  law  enforcement  actions,  leading  some  to  believe  that  it  is  not  possible  to  resolve 
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conflicts  by  defeating  the  "criminal  element,"  terrorist  or  otherwise,  in  global  society;  rather,  the 
only  reasonable  objective  is  to  "control  the  level  of  violence  and  destmction  to  some  level  of 
international  social  tolerance."®^  The  only  thing  that  is  abundantly  clear  is  that  the  national 
security  implications  of  these  threats  are  legion,  and  only  time  will  tell  exactly  how 
thoroughgoing  the  required  changes  will  be.  For  the  military,  they  will  undoubtedly  have  an 
impact  on  organization,  doctrine,  training,  equipment,  and  level  of  support  provided  to  civil 
agencies. 

Although  a  comprehensive  review  of  all  possible  implications  and  associated  responses  is 
quite  beyond  the  scope  of  this  monograph,  some  obvious  approaches  include  reassessing  the 
content  of  U.S.  government  Web  sites,  development  of  information  deterrence  or  "info  tech 
watch"  programs,  refining  awareness  of  how  terrorists  exploit  U.S.  freedom  of  access,  legal 
systems,  and  objectivity  through  use  of  information  technologies,  and  developing  a  more 
sophisticated  understanding  of  the  culture  of  information  terrorism  itself:  terrorist  information 
acquisition  and  dissemination  processes,  decision-making  protocols,  targeting  methodologies, 
financial  support  apparatuses,  and  even  their  cultural  or  social  rationale  for  acting. 

At  the  strategic  political  level,  however,  the  best  bang  for  the  U.S.  buck  will  probably  involve 
changes  in  intelligence  collection  and  dissemination,  immigration  policy,  and  exploitation  of 
innovative  or  evolving  information  technologies.  Because  of  the  ability  of  terrorist  groups  to 
remain  invisible  until  they  wish  to  be  seen,  coupled  with  their  ability  to  project  power  globally, 
the  chief  tasks  in  the  war  on  terror  must  be  to  physically  locate  cells  and  individual  operatives, 
then  targeting  them  or  keeping  them  out  of  the  country.  Defeating  the  networked  terrorist  threat 
will  thus  require  an  exceptional  level  of  effort  in  enhancing  friendly  intelligence  capabilities, 
shoring  up  immigration  loopholes,  and  leveraging  the  United  States'  already  considerable 
information  technology  superiority  to  increase  security.  Moreover,  because  of  the  comprehensive 

Leonard  Sullivan  Jr.,  "Meeting  the  Challenges  of  Regional  Security,"  1  February  1994  [online];  available 
from  <http://carlisle-www.army.mil/usassi/ssipubs/pubs94/chalnges/chalnges.pdf>  (accessed  27  September 
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effects  of  the  information  revolution  on  society,  these  areas  are  all  interrelated;  therefore, 
progress  will  have  to  be  measured  in  part  by  how  well  efforts  in  each  category  are  integrated  to 
complement  each  other. 

Enhancing  Intelligence  Capability 

Arguably,  the  single  biggest  challenge  facing  the  United  States  today  with  respect  to  terrorist 
threats  is  enhancing  its  already  formidable  intelligence  capabilities.  Although  better  intelligence 
will  not  necessarily  lead  to  better  threat  assessments,^®  the  threats  posed  by  pervasive  information 
technology  are  becoming  clearer.  Because  it  moves  globally  at  the  speed  of  light,  information 
technology  enables  and  facilitates  the  operations  of  networked  organizations  composed  of 
geographically  dispersed  "sleeper"  cells;  it  allows  terrorists  to  move  openly  without  attracting 
attention  -  at  least  in  liberal.  Western  democracies  -  while  simultaneously  strengthening  their 
ability  to  attack  in  a  coordinated  fashion,  from  a  distance,  and  at  a  place  and  time  of  their 
choosing.  The  worldwide  efforts  of  the  A1  Qaeda  organization,  coordinating  with  like-minded 
groups  in  a  violent  confrontation  with  the  West,  are  but  one  particularly  striking  example.  For 
these  reasons,  finding,  tracking  and  targeting  terrorist  cells  is  essential  to  combating  them.  The 
United  States  can  accomplish  this  objective  in  part  by  enhancing  intelligence  capability  across  the 
board,  but  particularly  in  intelligence  sharing  and  human  intelligence. 

One  way  the  United  States  can  increase  the  value  of  the  intelligence  it  collects  is  to  ensure  it 
gets  into  the  hands  of  relevant  users  in  a  timely  manner.  Against  a  networked  adversary  that 
exploits  the  advantages  of  information  technology,  an  intelligence  collection  and  dissemination 
system  with  minimal  obstacles  is  not  a  mere  convenience;  it  is  essential,  perhaps  even  of 
paramount  importance.  As  terrorist  organizations  increasingly  adopt  the  network  form,  states  and 

2001). 

Some  experts  see  the  "intelligence  failure"  leading  to  the  September  1 1  attacks  to  be  one  of  misplaced 
priorities  and  misallocation  of  resources,  based  on  partisan  political  agendas.  See,  for  example,  Joseph 
Cirincione,  "Defending  America,"  Georgetown  Journal  of  International  Affairs,  Winter/Spring  2002 
[online];  available  from  <http://cfdev.georgetown.edu/publications/journal/ws02cirincione.pdf>  (accessed 
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other  entities  attempting  to  combat  terrorism  may  very  well  have  to  become  less  hierarchical  and 
more  networked  to  be  successful,  if  for  no  other  reason  than  "it  takes  networks  to  fight 
networks."®’  Consequently,  government  agencies  must  themselves  become  less  hierarchical  and 
more  networked,  and  develop  ways  to  better  facilitate  information  sharing  of  all  types.  An 
adequate  system  will  facilitate  sharing  horizontally,  vertically,  and  across  the  spectmm  of  federal, 
state  and  local  organizations  that  depend  on  accurate  and  timely  intelligence  and  other 
information  to  support  decision-making  processes. 

At  every  echelon,  the  United  States  has  not  always  done  a  good  job  of  interagency 
coordination,  including  intelligence  sharing.  As  early  as  1997,  the  General  Accounting  Office 
concluded  that  the  Federal  government,  in  its  efforts  to  combat  terrorism,  had  no  instmments  or 
policies  in  place  to  ensure  effective  cooperation  among  interested  agencies,  accurate  prioritization 
of  requirements,  or  elimination  of  redundant  activities  and  capabilities.®*  Predictably  then, 
despite  a  sophisticated  electronic  intelligence  umbrella,  terrorists  were  able  to  penetrate  American 
defenses  with  seeming  aplomb,  prompting  some  experts  to  place  the  blame  for  the  September  1 1 
attacks  squarely  on  poor  interagency  coordination.  According  to  this  view,  the  problem  is  not 
necessarily  an  insufficient  amount  of  intelligence  collected,  nor  is  it  a  deficiency  in  collection 
methods;  it  is  more  "a  failure  of  national  [agency]  coordination,"  according  to  former  National 
Security  Agency  official  John  Garber.  "This  is  a  large  and  extremely  well-coordinated  attack.  In 
spite  of  our  best  efforts  to  coordinate  intelligence  collection  on  terrorists,  this  is  a  massive  failure 
of  national  cooperation."®® 
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Fortunately,  changes  are  either  underway  or  on  the  horizon  to  achieve  better  "cross  talk" 
between  intelligence  users.  Certain  provisions  of  the  Patriot  Act,  for  example,  will  permit 
broader  discretionary  intelligence  sharing  between  and  among  Federal  agencies.*  °°  Another, 
more  technical  measure  can  provide  the  capability  to  electronically  link  disparate  intelligence 
databases.  The  state  of  Pennsylvania  had  already  installed  such  a  network  -  Justice  Network,  or 
JNET  -  prior  to  the  World  Trade  Center  and  Pentagon  attacks,  and  actually  used  it  successfully 
during  its  investigation  of  the  crash  of  United  Airlines  Right  93. According  to  JNET 
developer  KPMG  Consulting,  this  system  is  able  to  link  existing  intelligence  databases  without 
modification,  and  within  a  secure  environment.  An  all-inclusive  system  similar  to  JNET, 
sponsored  at  the  Eederal  level  but  including  relevant  players  at  all  levels,  could  conceivably  allow 
law  enforcement  agencies  in  San  Erancisco,  for  example,  to  share  intelligence  with  a  military 
special  forces  team  on  the  other  side  of  the  globe  immediately  and  in  real  time,  and  vice-versa. 

Because  it  is  often  a  perishable  commodity,  agencies  at  all  levels  need  this  capability  to 
respond  to  useful  information  as  soon  as  possible;  hence,  they  need  access  to  all-source 
intelligence  with  minimal  delay.  At  the  very  least,  database  linking  can  afford  quicker  analysis 
and  response  times  for  all  agencies;  potentially,  it  can  also  provide  more  accurate  analysis,  since 
all  the  relevant  pieces  of  the  intelligence  "puzzle"  can  be  readily  available  to  multiple  analysts. 
Moreover,  systems  such  as  JNET  can  and  do  include  databases  not  just  from  the  intelligence  and 
law  enforcement  communities,  but  also  from  public  health  entities  -  effectively  enhancing 
disaster  preparedness  and  response  capabilities  as  well  as  intelligence  sharing.  When  coupled 
with  Bush  administration  efforts  to  coordinate  responses  to  terrorism  through  the  newly  created 
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Office  of  Homeland  Security  -  which,  perhaps  not  coincidentally,  is  tasked  to  "identify 
priorities"  and  "coordinate  efforts  for  collection  and  analysis  of  information  within  the  United 
States  regarding  threats  of  terrorism"  -  database- sharing  systems  can  significantly  increase 
U.S.  capability  to  find  and  thwart  terrorist  cells,  as  well  as  individual  operatives. 

At  the  same  time,  because  of  the  global  nature  of  the  terrorist  threat,  the  United  States  cannot 
focus  on  internal  intelligence  sharing  at  the  expense  of  intelligence  sharing  with  external  entities. 
In  their  study  of  what  they  call  the  "Afghan  Alumni,"  Shay  and  Schweitzer  contend  that  the  threat 
posed  by  terrorist  organizations  such  as  A1  Qaeda  is  not  a  concern  of  Western  civilization  alone, 
but  is  shared  with  moderate  Muslim  nations  and  countries  with  significant  Islamic  minorities. 

For  this  reason  among  others,  they  determined  that  the  only  way  to  defeat  A1  Qaeda  and  like- 
minded  transnational  groups  is  through  a  comprehensive  system  of  international  cooperation, 
particularly  with  respect  to  intelligence: 

The  widespread  distribution  of  the  "Afghan  Alumni"  and  the  lack  of  an  institutionalized 
and  centralized  system  makes  [sic]  it  difficult  to  penetrate  their  ranks  and  foil  their 
activities.  This  makes  international  intelligence  cooperation  between  potential  victims  of 
the  "Afghan  Alumni"  even  more  imperative.  The  purpose  of  such  cooperation  is  to  create 
a  database  and  monitor  the  movements  of  Afghan  activists  throughout  the  world. 

No  single  agency  or  nation  can  expect  satisfactory  results  if  they  go  it  alone  in  a  war  against  a 
networked,  global  opponent.  Whatever  other  options  the  United  States  and  its  allies  consider  in 
their  response  to  the  terrorist  threat,  it  is  clear  that  effective  cooperation  within  and  between 
friendly  intelligence  communities  is  essential  to  success. 

Although  national  and  international  coordination  is  cmcial  to  exploiting  available 
intelligence,  there  must  first  be  a  sufficient  quantity  of  all-source  intelligence  with  which  to  work. 
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Joint  Publication  2-0,  Doctrine  for  Intelligence  Support  to  Joint  Operations,  recognizes  the 
necessity  of  a  wide  range  of  intelligence  sources,  including  human  intelligence  (HUMINT),  to 
ensure  accuracy  of  information  as  well  as  counter  enemy  operational  security  and  deception 
practices. Nonetheless,  the  United  States  has  fallen  behind  in  both  the  quantity  and  quality  of 
its  HUMINT  capabilities,  at  least  at  the  strategic  level,  opting  instead  to  rely  on  technical 
solutions.  Some  scholars  such  as  Robert  D.  Steele  characterize  this  trend  as  a  "msh  to  spend 
billions  on  technology,  while  routinely  ignoring  the  challenges  and  opportunities  inherent  in 
human  collection,  open  source  collection,  foreign  area  expertise,  and  human  all-source 
analysis. The  Central  Intelligence  Agency  (CIA)  in  particular  has  been  slow  to  adapt  from  the 
Cold  War  standard  of  dependence  on  elaborate,  electronic  surveillance  and  reconnaissance 
systems.  As  early  as  1994,  Congress  was  investigating  ways  to  make  the  CIA  more  relevant  in  a 
post-Cold  War  world.  In  what  was  to  become  a  wholesale  reevaluation  of  the  agency, 
Pennsylvania  Senator  Arlen  Specter  contemplated  its  "total  overhaul"  while  others  questioned 
whether  the  CIA  was  even  necessary  or  relevant.'”^  Moreover,  since  the  mid-1970s  HUMINT 
has  been  more  or  less  relegated  to  the  back  burner  of  CIA  operations,  in  part  because  of  the 
Church  and  Pike  Committees'  revelations  of  CIA  foreign  assassination  plots  and  other,  so-called 
"dirty  tricks."'”*  General  Hugh  Shelton,  retired  Chairman  of  the  Joint  Chiefs  of  Staff,  recently 
commented  that  the  subsequent  desire  to  "get  out  of  the  human  intelligence  business"  was  in  large 
measure  responsible  for  the  alleged  intelligence  failures  surrounding  the  September  11  attacks.'”” 
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Since  then,  the  clarion-call  for  increased  HUMINT  has  been  virtually  incessant;  this  has  resulted 
in  governmental  efforts  to  substantially  augment  intelligence  spending,  including  a  planned  "five- 
year  effort"  to  address  intelligence  shortfalls  with  emphasis  on  "correcting  deficiencies  in  human 
intelligence. 

While  any  effort  augmenting  its  inadequate  HUMINT  capability  is  a  step  in  the  right 

direction,  the  United  States  faces  a  long,  difficult  road  in  terms  of  the  timeline  required  to  realize 

concrete  benefits.  As  President  George  W.  Bush  stated  in  his  2002  State  of  the  Union  address, 

"time  is  not  on  our  side;"  this  is  tme  not  only  because  of  the  dangers  of  increased  proliferation  of 

weapons  of  mass  destmction.  ‘ '  *  Adequate  HUMINT  capability,  particularly  one  deployed 

against  a  networked  non-state  actor,  takes  time  and  effort  to  cultivate.  It  does  not  instantaneously 

materialize,  as  it  were,  out  of  whole  cloth.  Robert  J.  Heibel,  former  Deputy  Chief  of 

Counterterrorism  for  the  Federal  Bureau  of  Investigation,  related  the  situation  succinctly  in  his 

remarks  following  the  September  11  attacks: 

If  the  perpetrators  are  in  fact  Islamic  extremists,  by  the  very  nature  of  their  organization, 
there's  a  real  law  enforcement  security  penetration  problem.  In  all  likelihood  they  grew 
up  together,  they  are  related  somehow,  members  of  the  same  tribe  and  they  have  a 
common  fervor  and  hate  for  Western  society.  It  is  not  just  a  matter  of  saying  "let's  put 
five  agents  undercover  and  penetrate  the  group."  It  is  a  very  difficult  operation.  It  takes 
a  great  deal  of  planning  and  preparation. 

How  much  "planning  and  preparation"  is  a  subject  of  debate;  however,  most  sources  have 
suggested  that  it  could  take  many  years  for  the  CIA  to  assemble  the  assets  and  build  the 
organization  required  to  insert  reliable  agents  into,  for  example,  a  single  radical  Islamic  terrorist 
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network."^  Still,  increased  HUMINT  capability  is  an  investment  the  United  States  must  make 

despite  the  costs,  simply  because  reliance  only  on  electronic  intelligence  will  not  be  sufficient  to 

achieve  its  objectives.  Imagery  intelligence  (IMINT)  is  frequently  limited  by  a  number  of  factors, 

particularly  weather  and  terrain.  Moreover,  all  forms  of  electronic  intelligence,  including 

measurement  and  signature  intelligence  (MASINT)  and  signals  intelligence  (SIGINT),  typically 

reveal  where  an  enemy  is  (or,  perhaps  more  often,  where  an  enemy  was).  Even  so,  they  cannot 

reliably  and  in  all  cases  determine  precise  enemy  locations,  much  less  predict  activity  or 

intentions. '  HUMINT,  whether  collected  from  infiltrators  or  informants,  is  an  essential  element 

of  an  all-source  intelligence  apparatus,  particularly  for  accurately  predicting  where  an  enemy  will 

be.  This  capability  is  especially  important  to  ensure  success  in  foiling  terrorist  attacks,  including 

employment  of  weapons  of  mass  destmction: 

There  is  simply  no  other  way  to  acquire  the  kind  of  insider  information  America  needs 
for  its  defense.  HUMINT  provides  intimate  knowledge  of  the  capabilities  of  our 
potential  enemies  that  will  help  America  prepare  the  necessary  defenses.  More 
importantly,  HUMINT  provides  the  best  information  on  our  potential  enemies’  intentions 
and  could  offer  us  the  only  warning  of  an  impending  attack  or  the  only  clue  as  to  a 
devastating  attack’s  perpetrators  and  sponsors."^ 

The  benefits  of  enhanced  HUMINT  capability  are  not  limited  to  finding  and  targeting 
terrorists  themselves,  however;  they  apply  equally  well  to  disrupting  terrorist  financial  networks. 
Good  HUMINT  is  necessary  to  cut  off  terrorist  funding  and  money-laundering  efforts, 
particularly  where  there  are  no  electronic  transfers  to  trace.  Although  electronic  funds  transfers 
are  appealing  for  a  number  of  previously  examined  reasons,  other  methods  of  accomplishing 
unregulated  transactions  are  also  available.  One  example  is  the  hawala  system,  which  has  been 
in  use  throughout  South  Asia  and  the  Middle  East  for  centuries.  The  hawala  system  is  cash-only. 
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informal  and  anonymous,  with  few  record  keeping  conventions;  indeed,  records  are  usually 
destroyed  upon  completion  of  the  transaction.  Moreover,  thorough  examination  of  the  sheer 
volume  of  financial  transactions  worldwide  -  electronic  or  otherwise  -  is  a  daunting  challenge, 
and  probably  not  cost  effective.  "Catching  terrorists  'is  not  something  you're  going  to  do  by 
looking  at  the  haystack  of  financial  transactions,'  says  Treasury  Secretary  Paul  H.  O'Neill.  'It 
comes  from  intelligence'  that  provides  banks  and  allies  with  targeted  accounts  to  watch. 


Immigration  Reform 

One  of  the  most  important  beneficiaries  of  enhanced  intelligence  sharing  and  HUMINT  will 
be  Federal  immigration  authorities.  The  September  1 1  hijackers,  according  to  most  accounts,  all 
entered  the  United  States  legally,  effectively  exploiting  what  has  historically  been  a  porous  border 
with  limited  obstacles  to  entry.  Prior  identification  of  the  culprits  as  A1  Qaeda  operatives  —  based 
on  timely  collection  and  dissemination  of  intelligence  -  could  have  prevented  their  entry,  and 
thus  the  tragedies  that  ensued  in  New  York,  Washington  and  Pennsylvania.  However,  the 
immigration  process  in  the  United  States  is  in  some  ways  deficient  in  and  of  itself;  therefore, 
immigration  reform  is  also  important  in  a  thoroughgoing  program  to  counter  the  terrorist  threat. 

Part  of  the  U.S.  immigration  problem  is  organizational.  As  recently  as  December  23,  2001, 
issuance  of  most  U.S.  visas  was  the  responsibility  of  the  State  Department's  Bureau  of  Consular 
Affairs;"*  regulation  of  immigration  and  border  control  procedures,  however,  were  under  the 
purview  of  the  Justice  Department's  Immigration  and  Naturalization  Service."^  This 
organizational  setup  has  prompted  numerous  experts,  including  Steven  A.  Camarota,  Director  of 
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Research  for  the  Center  for  Immigration  Studies,  to  see  an  inherent  conflict  of  interest  between 
the  two  functions: 


. .  .it  is  difficult  to  imagine  two  less  complementary  functions  than  diplomacy  and 
immigration  enforcement.  The  diplomat’s  goal  of  promoting  cooperation  and 
compromise  is  sometimes  in  conflict  with  the  gatekeeper’s  goal  of  exposing  fraud  and 
ensuring  compliance  with  the  law.  This  systemic  mismatch  is  likely  to  persist  regardless 
of  management  changes  and  may  only  be  remedied  by  transferring  all  visa-issuing 
responsibilities  overseas  to  the  INS  or  perhaps  a  new  "Visa  Corps." 

Repairing  whatever  shortcomings  exist  in  visa-issuance  procedures,  of  course,  will  do 
nothing  to  stem  the  flow  of  illegal  aliens  who  waltz  across  U.S.  borders  without  any 
documentation  at  all.  Hence,  additional  personnel  and  resources  are  required  for  border  and  port- 
of-entry  security  agencies  such  as  the  INS,  Border  Patrol  and  Customs  Service.  Also,  because  of 
the  historically  open  borders  the  United  States  has  shared  with  Canada  and  Mexico,  cooperation 
with  those  two  nations  will  be  essential  in  creating  integrated  North  and  Central  American 
security  networks,  not  only  to  intercept  terrorist  operatives  attempting  to  enter  the  continent,  but 
also  to  foil  possible  efforts  to  import  weapons  of  mass  destruction.  Sound  objectives  of  such 
integration  would  include  shutting  down  or  disrupting  drug-  and  migrant-smuggling  operations, 
intelligence  sharing,  law  enforcement  cooperation,  and  swift  implementation  of  joint  enforcement 
procedures.*^' 

For  all  of  these  initiatives,  technology  can  expedite  and  facilitate  change,  although  historical 
attempts  to  implement  technological  solutions  to  immigration  problems  have  been  less  than 
completely  successful.  As  early  as  1994,  the  U.S.  Commission  on  Immigration  Reform  called  for 
a  computerized  registry,  based  on  the  Social  Security  Account  Number,  to  verify  work 
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authorizations  for  immigrants  on  work  visas/ Subsequent  Congressional  attempts  to  institute  a 
national  identification  card  system  for  immigrants  on  work  and  student  visas  was  passed  by  the 
House  of  Representatives,  but  failed  a  Senate  vote/^^  Creation  of  an  automated  system  for  entry- 
exit  tracking  of  immigrants  should  receive  new  emphasis  now,  in  light  of  the  events  of  September 
1 1 .  Easy  ways  around  the  current  entry-exit  tracking  system  abound;  under  the  current  system, 
there  is  no  way  to  know,  reliably  and  with  precision,  whether  short-term  immigrants  have  actually 
left  the  country,  particularly  if  they  travel  by  land.  One  way  to  increase  confidence  in  the 
system  would  be  to  institute  a  comprehensive,  electronic  visa  system  such  as  the  one  currently 
fielded  by  Australia.  According  to  Australia's  Department  of  Immigration  and  Multicultural  and 
Indigenous  Affairs,  its  Electronic  Travel  Authority  visas  are  automatically  tracked  and  recorded 
in  a  national  database,  which  not  only  simplifies  entry-exit  tracking,  but  is  also  convenient  for  the 
traveler. 

The  U.S.  Congress  is  currently  contemplating  legislation  to  address  some  of  these  concerns. 
House  Resolution  3525  authorizes  implementation  of  electronic  visa  files  (section  301),  an 
integrated  entry  and  exit  data  system  (section  202  and  303),  and  identification  documents  for 
"certain"  newly  admitted  aliens  (section  309).  Eurther,  it  prescribes  200  additional  INS 
inspectors  and  200  additional  investigative  personnel,  along  with  their  associated  support  staffs, 
per  fiscal  year  in  2002  through  2006  (section  101).  Swift  Senate  consideration  and  passage  of 
these  provisions  is  necessary. 
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Leveraging  Technological  Superiority 


Technological  solutions  such  as  those  contemplated  by  House  Resolution  3525  are  not 
limited  to  immigration  fixes.  As  the  United  States  becomes  more  and  more  an  information 
culture,  information  technology  superiority  will  continue  to  be  one  of  its  strong  suits.  Not 
surprisingly,  technological  innovation  will  therefore  continue  to  play  a  role  in  the  war  on 
terrorism.  Further  developments  in  automated  weapons  and  sensing  platforms  will  certainly 
contribute;  civil  liberties  concerns  notwithstanding,  next-generation  Internet  surveillance 
capabilities  such  as  the  recently  acknowledged  Magic  Lantern  program  will  also  be  required. 
However,  key  components  of  a  near-term  friendly  strategy  to  exploit  information  technology 
should  also  include  leveraging  capabilities  to  provide  better  information  security  and  physical 
security. 

As  previously  discussed,  the  Internet's  origins  have  much  to  do  with  its  vulnerability. 

Because  its  precursor,  ARPANET,  was  a  closely  held  asset  shared  among  a  small  group  of  tmsted 
users,  it  was  "originally  designed  for  openness  and  flexibility,  not  for  security."'^®  This  open 
architecture  has  carried  over  as  the  Internet  has  grown,  resulting  in  the  vulnerabilities  discussed  in 
Chapter  Five;  moreover,  despite  widespread  knowledge  of  these  vulnerabilities,  computer 
security  practices  are  highly  variable  in  terms  of  quality,  efficacy  and  level  of  enforceability.  In 
the  near  term,  part  of  the  solution  to  network  vulnerability  will  be  administrative  rather  than 
technological:  the  United  States  must  encourage  cooperative  efforts  among  government  and 
private  users  to  increase  understanding  of  and  adherence  to  generally  accepted  computer  security 
practices.  Differences  in  computer  security  policy,  as  well  as  unevenly  applied  and  enforced 
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policies,  create  seams  that  are  subject  to  attack  by  malicious  elements.  Hence,  standardization  is 
a  necessary  feature  of  comprehensive  computer  network  security.  Although  there  is  no  such 
thing  as  zero  risk,  an  intensive  program  to  implement  uniform  computer  security  practices  is 
essential  to  make  the  Internet  as  secure  as  it  can  possibly  be.  In  addition,  "high-value"  systems  - 
such  as  those  employing  SCADA  software  for  control  of  critical  infrastructure  -  must  be 
confined  to  closed  networks  inaccessible  through  the  Internet  at  large,  at  least  until  adequate 
technological  solutions  to  address  security  concerns  are  developed. 

Although  network  vulnerability  -  and  thus  information  security  -  is  at  some  level  a  user  and 
agency  responsibility,  there  are  also  technological  efforts  underway  to  increase  the  Web's 
intrinsic  security  without  impairing  its  openness  or  flexibility.  One  such  initiative  is  Next- 
Generation  Internet  Protocol.  This  proposed  standard  would  use  cryptographic  techniques  to 
provide  host  authentication,  as  well  as  positive  identification  of  authorized  users.  Although 
completion  of  work  on  the  new  protocol  is  years  away  -  including  a  planned  multi-year  phase-in 
period  -  it  is  hoped  that  it  will  provide  more  intrinsic  security. 

Automated  systems  can  also  contribute  to  physical  security  in  a  variety  of  ways.  Biometrics  - 
-  the  use  of  unique  physiological  or  behavioral  characteristics  for  positive  identification  of 
individuals  -  has  been  either  explored  or  in  use  in  a  variety  of  states  and  countries.  The  Texas 
Department  of  Public  Safety,  for  example,  has  taken  thumbprints  of  licensed  drivers  for  decades, 
and  has  recently  begun  capturing  thumbprint  images  electronically  in  the  process  of  issuing  new 
and  renewal  licenses  and  identification  cards.'^°  Recently,  the  Netherlands  and  other  countries 
have  been  exploring  the  use  of  electronic  iris  and  facial  scans  for  positive  identification  of 
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immigrants,  in  part  based  on  the  inadequacy  of  passport  photographs  as  a  means  of  positive 
identification. 

The  ability  to  distinguish  between  community  members  and  outsiders  is,  in  some  ways,  a 
basic  need  of  any  society.  Positive  identification  of  friend  and  foe,  however,  becomes  an 
essential  requirement  for  a  society  in  conflict,  even  if  civil  liberties  are  perceived  to  be  at  stake. 
To  this  end,  aggressive  development  of  biometric  systems  has  several  distinct  virtues.  First,  they 
are  no  more  intmsive,  physically  or  legally,  than  photography  or  conventional  fingerprinting. 
Second,  the  spiraling  growth  of  electronic  transactions  -  such  as  online  driver  license  renewals, 
visa  applications,  and  various  forms  of  electronic  commerce  -  make  reliable,  positive  electronic 
identification  important  for  individual  as  well  as  collective  security.  Finally,  in  addition  to 
positive  identification,  biometrics  can  also  provide  negative  identification:  or,  in  the  words  of 
biometrics  researcher  Jim  Weyman,  proof  that  "you  are  not  who  you  say  you  are  not."  This 
feature  is  critical  to  protect  against  attempts  to  fraudulently  obtain  multiple  driver  licenses  or 
other  documents  that  could  facilitate  terrorist  operations  within  U.S.  borders. 

Perhaps  the  best  feature  of  a  biometrics  system,  if  properly  integrated,  is  that  it  requires  little 

or  no  intrinsic  security,  since  it  compares  live  subjects  to  recorded  data.  Computer  security 

expert  Dorothy  Denning  argues  that  fears  of  biometric  data  counterfeiting  or  other  criminal 

"workarounds"  are  unfounded,  and  in  fact  miss  the  point  of  biometrics  entirely: 

What  makes  biometrics  successful  is  not  secrecy,  but  rather  the  ability  to  determine 
"liveness."  I  can  easily  distinguish  the  living,  flesh-and-blood  you  from  a  statue  or 
photograph  of  you,  or  even  someone  wearing  a  costume  and  mask  that  looks  like  you.  . . . 
If  I  don't  know  you  at  all,  I  might  ask  for  a  photo  ID.  But  I  would  use  such  a  photo  only 
because  I  lack  knowledge  of  your  appearance.  I  authenticate  you  by  comparing  your  live 
face  against  the  photo,  not  by  comparing  one  photo  against  another.  . . .  The  same 
principle  applies  in  the  digital  world.  Your  biometric  prints  need  not  be  kept  secret,  but 
the  validation  process  must  check  for  liveness  of  the  readings. 


Joris  Evers,  "Dutch  Government  Uses  Biometrics  to  ID  Immigrants,”  CNN,  19  April  2001  [online]; 
available  from  <http://www.cnn.eom/2001ArECH/ptech/04/19/biometric.ID.idg/index.html>  (accessed  23 
December  2001). 
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Information  technology  is  used  in  other  ways  to  bolster  physical  security.  Remotely  panning 
video  cameras  and  other  surveillance  devices  have  been  in  use  for  years  on  U.S.  Air  Force 
installations,  particularly  during  the  Cold  War  when  nuclear-armed  aircraft  maintained  strip  alert. 
In  the  private  sector,  they  continue  to  be  used  in  mercantile  applications  in  an  attempt  to  thwart 
incidents  of  shoplifting  and  armed  robbery;  in  some  jurisdictions,  cameras  capture  license  plate 
numbers  of  speeding  vehicles,  providing  law  enforcement  with  an  automated  tool  to  punish 
offenders.  Recently,  hybrid  arrangements  that  incorporate  elements  of  surveillance  and  in-transit 
visibility  systems  have  been  suggested  as  a  means  of  providing  advance  warning  of  the  contents 
of  shipping  containers  bound  for  the  U.S.,  as  well  as  alerts  of  possible  en  route  tampering,  using 
Global  Positioning  System  satellites  and  secure  ship-to-shore  communications.  The  continuing 
need  to  enhance  physical  security  in  the  face  of  a  networked  terrorist  adversary  will  require 
similar  innovative  applications  of  information  technology  in  the  future. 

Last,  but  not  least,  are  promising  future  technologies  related  to  information  warfare.  Edward 
Waltz  has  cataloged  a  variety  of  potential  emerging  capabilities,  including  collection,  processing, 
dissemination/presentation,  offensive  and  defensive  technologies  that  may  have  a  considerable 
positive  impact  on  U.S.  information  dominance  in  the  long  term.  Some  of  the  more  interesting 
capabilities  include  intelligent,  unattended  ground  sensors,  hyperspectral,  integrated  aperture 
sensing,  ultraspectral  and  all-spectral  sensing,  distributed  operating  systems  with  mediated, 
heterogeneous  databases,  digital  organisms,  quantum  computing  and  storage,  and  a  host  of  other 
possibilities.'^^  Of  course,  this  is  not  to  say  that  technological  innovation  is  a  panacea.  No 
application  of  technology  will  wholly  preclude  terrorist  operations;  some  groups,  for  example,  are 
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known  to  be  using  combinations  of  low-  and  high-tech  methods  to  exercise  command,  control 
and  communications.  Nonetheless,  a  failure  to  exploit  the  United  States'  overwhelming 
technological  superiority  would  be  a  serious  error. 
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